CVE-2023-53903

MEDIUM

WebsiteBaker 2.13.3 - XSS

Title source: llm

Description

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files with script tags that execute when the file is viewed, enabling persistent cross-site scripting attacks.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Mirabbas Ağalarov · textwebappsphp

https://www.exploit-db.com/exploits/51553

View Code ZIP pw:eip

References (3)

[Product] https://websitebaker.org/pages/en/home.php

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/51553

[Third Party Advisory, Exploit] https://www.vulncheck.com/advisories/websitebaker-stored-cross-site-scripting-via-svg-file-upload

Scores

CVSS v3 5.4

EPSS 0.0005

EPSS Percentile 14.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

websitebaker/websitebaker 2.13.3

websitebaker/WebsiteBaker 2.13.3

Published Dec 16, 2025

Tracked Since Feb 18, 2026