The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
References
Configurations
History
21 Nov 2024, 07:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/ddb4c95d-bbee-4095-aed6-25f6b8e63011 - Exploit |
05 Jun 2023, 14:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wpscan.com/vulnerability/ddb4c95d-bbee-4095-aed6-25f6b8e63011 - Exploit | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
| CPE | cpe:2.3:a:autoptimize:autoptimize:*:*:*:*:*:wordpress:*:* |
30 May 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-30 08:15
Updated : 2025-01-10 21:15
NVD link : CVE-2023-2113
Mitre link : CVE-2023-2113
CVE.ORG link : CVE-2023-2113
JSON object : View
Products Affected
autoptimize
- autoptimize
CWE
No CWE.