CVE-2023-5013: XSS in Pluck CMS 4.7.18

Successful exploitation of CVE-2023-5013 allows an attacker to inject arbitrary JavaScript code into the Pluck CMS application. This can lead to a variety of malicious actions, including stealing user cookies, redirecting users to phishing sites, or defacing the website. The attack is remotely exploitable, meaning an attacker does not need to be on the same network as the CMS. While the complexity of the attack is considered high, the public disclosure of the vulnerability increases the risk of exploitation, particularly if users have not yet applied the patch.

1. Reserved2023-09-16
2. Published2023-09-16
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5013 is to upgrade Pluck CMS to version 4.7.19 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the contents parameter in install.php to prevent the injection of malicious scripts. While a Web Application Firewall (WAF) might offer some protection, it is not a substitute for patching the vulnerable software. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into the contents parameter of install.php and confirming that it is properly sanitized.