CVE-2023-53909

Medium · 5.4

CVSS

5.4

EPSS

0.3%

Published

Dec 17, 2025

CISA due date

—

The record

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the /wbce/modules/elfinder/ef/php/connector.wbce.php endpoint and execute JavaScript when victims access the uploaded file.

Affected packages

Ecosystem	Package	Introduced	Fixed