CVE-2023-53953

MEDIUM

WebsiteBaker 2.13.3 - Authenticated Stored Cross-Site Scripting via Page Title

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-53953. PoCs published by Mirabbas Ağalarov.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in WebsiteBaker v2.13.3. The payload is injected via the 'title' parameter in a POST request to the page creation endpoint, triggering when the page is visited.

Description

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating web pages. Attackers can craft malicious payloads in page titles that execute arbitrary JavaScript when the page is viewed by other users.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Mirabbas Ağalarov · textwebappsphp
https://www.exploit-db.com/exploits/51349

This exploit demonstrates a stored XSS vulnerability in WebsiteBaker v2.13.3. The payload is injected via the 'title' parameter in a POST request to the page creation endpoint, triggering when the page is visited.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WebsiteBaker v2.13.3
Auth required
Prerequisites: Valid session cookie (PHPSESSID-WB-0e93a2) · Permissions to create pages
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/51349

Scores

CVSS v3 5.4
EPSS 0.0020
EPSS Percentile 10.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
websitebaker/websitebaker 2.13.3
Websitebaker/WebsiteBaker 2.13.3
Published Dec 19, 2025
Tracked Since Feb 18, 2026