PT-2023-6574 · 10Web · Image Optimizer

Phạm Ngọc Khánh

·

Published

2023-04-26

·

Updated

2023-08-22

·

CVE-2023-2122

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Image Optimizer by 10web WordPress plugin version 1.0.26 and earlier
Description The issue is related to the Image Optimizer by 10web WordPress plugin, which does not properly sanitise and escape the iowd tabs active parameter before rendering it in the plugin admin panel. This leads to a reflected Cross-Site Scripting issue, allowing an attacker to trick a logged-in admin into executing arbitrary JavaScript by clicking a link. The vulnerability can be exploited by a remote attacker to conduct cross-site scripting attacks.
Recommendations For versions prior to 1.0.27, update to version 1.0.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin admin panel to minimize the risk of exploitation. Avoid using the iowd tabs active parameter in the affected plugin admin panel until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07338
CVE-2023-2122

Affected Products

Image Optimizer