CVE-2023-5793: XSS in flusity CMS

Successful exploitation of CVE-2023-5793 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious actions, including stealing user credentials, redirecting users to phishing sites, or modifying the content of the website. The vulnerability is remotely exploitable, meaning an attacker does not need to be authenticated to exploit it. Given the nature of XSS vulnerabilities, the potential impact can range from minor defacement to complete compromise of user accounts and data. The lack of versioning makes it difficult to determine the precise scope of affected installations, increasing the overall risk.

1. Reserved2023-10-26
2. Published2023-10-26
3. Modified2025-06-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5793 is to apply the provided patch: 81252bc764e1de2422e79e36194bba1289e7a0a5. Since flusity CMS lacks versioning, applying this patch is the only known remediation. Consider implementing a Web Application Firewall (WAF) with XSS filtering rules as an additional layer of defense. Regularly review and sanitize user input to prevent future XSS vulnerabilities. After applying the patch, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) through the custom block creation form and confirming that the script is not executed.