CVE-2023-0603
Published: 08 May 2023
Summary
CVE-2023-0603 is a high-severity an unspecified weakness vulnerability in Sloth Logo Customizer Project Sloth Logo Customizer. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 23.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Sloth Logo Customizer WordPress plugin through version 2.0.2 is affected by a vulnerability that combines missing CSRF protection on settings updates with absent input sanitization and output escaping. This flaw is tracked as CVE-2023-0603 and carries a CVSS 3.1 score of 8.8.
An unauthenticated attacker can craft a malicious request that, when visited by a logged-in administrator, causes the administrator’s browser to store persistent XSS payloads in the plugin settings. Successful exploitation grants the attacker the ability to execute arbitrary scripts in the context of other administrators, potentially leading to account takeover or further site compromise.
The associated EPSS score began at a low level, rose materially to a peak of 0.0837 on 2026-03-04, and has since receded to 0.0096, indicating a period of increased exploitation interest after public disclosure. WPScan published technical details of the issue at the referenced advisory URL.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12641
Vulnerability details
The Sloth Logo Customizer WordPress plugin through 2.0.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a…
more
CSRF attack
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.