What’s Vulnerable › Vulnerabilities

CVE-2023-53932: Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-79

Description

Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that will execute when other users view the compromised blog post.

Affected products

• s9y Serendipity: 2.4.0

References

• https://docs.s9y.org/
• https://www.exploit-db.com/exploits/51373
• https://www.vulncheck.com/advisories/serendipity-stored-cross-site-scripting-via-admin-entry-creation
• https://www.exploit-db.com/exploits/51373

Get alerted when CVE-2023-53932 or the next vulnerability affects your stack