CVE-2023-2122

MEDIUMNuclei

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-2122 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 8, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Image Optimizer by 10web

Default status: unaffected

CVE ListBefore 1.0.27affected

Nuclei templates

1
ProjectDiscoveryMEDIUMImage Optimizer by 10web < 1.0.26 - Cross-Site ScriptingCVSS 6.1

Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowd_tabs_active parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Unauthenticated attackers can inject malicious JavaScript through the iowd_tabs_active parameter to steal WordPress administrator session cookies.

Remediation

Fixed in version 1.0.27

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2023cvewpscanxssimage-optimizer-wdwordpresswp-pluginwpauthenticated10webvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:10web:image_optimizer:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/936fd93a-428d-4744-a4fc-c8da78dcbe78 https://wordpress.org/plugins/image-optimizer-wd/advanced/ https://nvd.nist.gov/vuln/detail/CVE-2023-2122

Source: ProjectDiscovery

References

2