CVE-2023-0334

Deeper analysis

The ShortPixel Adaptive Images WordPress plugin before version 3.6.3 contains a reflected cross-site scripting vulnerability. The flaw arises because the plugin fails to sanitize and escape a parameter before reflecting it back into page output, allowing script injection that targets high-privilege users such as administrators. The issue carries a CVSS 3.1 score of 6.1 with network attack vector and required user interaction.

An unauthenticated attacker can exploit the vulnerability by delivering a crafted URL to an administrator or other privileged user. If the victim interacts with the link, the attacker can execute arbitrary JavaScript in the victim's browser session, enabling actions such as session hijacking or unauthorized administrative changes within the WordPress site.

The associated EPSS probability rose from lower values to a recorded peak of 0.2661 before receding to the current score of 0.0813, indicating a period of elevated exploitation interest after public disclosure. The primary reference is the WPScan advisory that documents the reflected XSS condition and the affected plugin versions.