PT-2023-6574 · 10Web · Image Optimizer
Phạm Ngọc Khánh
·
Publicado
2023-04-26
·
Atualizado
2023-08-22
·
CVE-2023-2122
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Image Optimizer by 10web WordPress plugin version 1.0.26 and earlier
Description
The issue is related to the Image Optimizer by 10web WordPress plugin, which does not properly sanitise and escape the
iowd tabs active parameter before rendering it in the plugin admin panel. This leads to a reflected Cross-Site Scripting issue, allowing an attacker to trick a logged-in admin into executing arbitrary JavaScript by clicking a link. The vulnerability can be exploited by a remote attacker to conduct cross-site scripting attacks.Recommendations
For versions prior to 1.0.27, update to version 1.0.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin admin panel to minimize the risk of exploitation. Avoid using the
iowd tabs active parameter in the affected plugin admin panel until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Image Optimizer