CVE-2023-5538

HIGH

MpOperationLogs < 1.0.1 - Unauthenticated Stored Cross-Site Scripting via IP Request Headers

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-5538. PoCs published by juweihuitao.

AI-analyzed exploit summary The repository contains a README describing CVE-2023-5538, an unauthenticated stored XSS vulnerability in the WordPress plugin MpOperationLogs version <= 1.0.1. No exploit code is provided, only a brief description of the vulnerability.

Description

The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Exploits (1)

nomisec WRITEUP
by juweihuitao · poc
https://github.com/juweihuitao/MpOperationLogs

The repository contains a README describing CVE-2023-5538, an unauthenticated stored XSS vulnerability in the WordPress plugin MpOperationLogs version <= 1.0.1. No exploit code is provided, only a brief description of the vulnerability.

Classification
Writeup 80%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: WordPress plugin MpOperationLogs <= 1.0.1
No auth needed
Prerequisites: WordPress installation with vulnerable MpOperationLogs plugin
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 7.2
EPSS 0.0098
EPSS Percentile 57.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
burningx/mpOperationLogs < 1.0.1
mrpeng/mpoperationlogs < 1.0.1
Published Oct 18, 2023
Tracked Since Feb 18, 2026