CVE-2023-1119
Published: 10 July 2023
Summary
CVE-2023-1119 is a medium-severity an unspecified weakness vulnerability in Srbtranslatin Project Srbtranslatin. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a reflected cross-site scripting flaw in the WP-Optimize WordPress plugin before version 3.2.13 and the SrbTransLatin WordPress plugin before version 2.4.1. Both plugins incorporate a third-party library that strips escaping from certain HTML characters, allowing attacker-controlled input to be rendered without proper sanitization in the context of a victim's browser.
An unauthenticated remote attacker can exploit the issue by crafting a malicious link and tricking a user into clicking it. Successful exploitation results in script execution that can read limited data from the affected site or perform actions on behalf of the victim within the site's origin, corresponding to the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
The referenced WPScan advisories indicate that the issue is resolved by updating WP-Optimize to 3.2.13 or later and SrbTransLatin to 2.4.1 or later.
The EPSS score remains flat at 0.2422 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-23402
Vulnerability details
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.