CVE-2023-35883 MEDIUM

CVE-2023-35883: WordPress Core Web Vitals & PageSpeed Booster Plugin <= 1.0.12 is vulnerable to Open Redirection

Vendor Magazine3
Product Core Web Vitals & PageSpeed Booster
Weakness CWE-601 · Open redirect
Published December 19, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.

Explanation of Vulnerability in Simple Terms

02Summary

The Core Web Vitals & PageSpeed Booster plugin contains an open redirect vulnerability that allows an attacker to redirect users to an external website. The vulnerability requires user interaction—the victim must click a malicious link. The redirect can occur across different domains, potentially enabling phishing or credential theft attacks.

What an attacker can do

03Attacker Capabilities

Redirect site visitors to an external website, potentially for phishing or malware distribution.

Potential impact on your site

04Site Impact

Site visitors could be redirected away from your site to attacker-controlled pages, damaging trust and enabling phishing.

Conditions required to exploit

05Prerequisites

Victim must click a crafted link containing a malicious redirect parameter; no authentication required.

Key dates

06Disclosure timeline

December 19, 2023 CVE published
April 28, 2026 Record updated