The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/936fd93a-428d-4744-a4fc-c8da78dcbe78 | Exploit Third Party Advisory |
Configurations
History
07 Nov 2023, 04:12
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
22 Aug 2023, 16:44
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | (MISC) https://wpscan.com/vulnerability/936fd93a-428d-4744-a4fc-c8da78dcbe78 - Exploit, Third Party Advisory | |
| First Time |
10web image Optimizer
10web |
|
| CPE | cpe:2.3:a:10web:image_optimizer:*:*:*:*:*:wordpress:*:* |
16 Aug 2023, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-16 12:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-2122
Mitre link : CVE-2023-2122
CVE.ORG link : CVE-2023-2122
JSON object : View
Products Affected
10web
- image_optimizer
CWE
No CWE.