CVE-2023-1119: Multiple Plugins - Cross-Site Scripting From Third-party Library

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-10 · updated 2026-06-17

Description

The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.

Affected products

Srbtranslatin Project Srbtranslatin: before 2.4 — fixed in 2.4
WP-Optimize: before 3.2.13 — fixed in 3.2.13

How to fix

Upgrade to a fixed version: Srbtranslatin Project Srbtranslatin 2.4; WP-Optimize 3.2.13. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06
https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06

Get alerted when CVE-2023-1119 or the next vulnerability affects your stack