Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Piwigo - CVE-2023-44393
Published: October 6, 2023 / Updated: April 26, 2026
Vulnerability identifier: #VU127935
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-44393
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script code in an administrator's browser.
The vulnerability exists due to improper neutralization of script-related html tags in /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here] when handling a crafted plugin_id parameter in a request. A remote attacker can send a specially crafted URL to execute arbitrary script code in an administrator's browser.
User interaction is required, and the victim must be logged in as an administrator and visit the crafted URL.
Affected software
Piwigo
How to mitigate CVE-2023-44393
Install security update from vendor's website.
Piwigo - update to 13.8.0