CVE-2023-0334

MEDIUMNuclei

ShortPixel Adaptive Images < 3.6.3 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-0334 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ShortPixel Adaptive Images

Default status: unaffected

CVE ListBefore 3.6.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMShortPixel Adaptive Images < 3.6.3 - Cross Site ScriptingCVSS 6.1

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin

Impact

Unauthenticated attackers can inject malicious JavaScript to steal high-privilege user session cookies including administrator credentials.

Remediation

Fixed in version 3.6.3

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvexsswpscanwordpresswp-pluginwpshortpixel-adaptive-imagesshortpixelvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:shortpixel:shortpixel_adaptive_images:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/shortpixel-adaptive-images/
FOFA: body=/wp-content/plugins/shortpixel-adaptive-images/
https://wpscan.com/vulnerability/b027a8db-0fd6-444d-b14a-0ae58f04f931 https://nvd.nist.gov/vuln/detail/CVE-2023-0334

Source: ProjectDiscovery

References

2