CVE-2023-40553 MEDIUM

CVE-2023-40553: WordPress Plausible Analytics Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Vendor Plausible.io
Product Plausible Analytics
Weakness CWE-79 · XSS
Published September 6, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Plausible.Io Plausible Analytics plugin <= 1.3.3 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Plausible Analytics versions up to 1.3.3 contain a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into the application. The vulnerability requires user interaction and network access but does not require authentication. An attacker can craft a malicious link or page that, when visited by a user, executes arbitrary JavaScript in their browser within the Plausible Analytics context.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in a user's browser within the Plausible Analytics application.

Potential impact on your site

04Site Impact

Users of Plausible Analytics may have their session compromised, credentials stolen, or be redirected to malicious sites if they click attacker-controlled links.

Conditions required to exploit

05Prerequisites

The victim must visit a malicious link or page crafted by the attacker while logged into or viewing Plausible Analytics.

Key dates

06Disclosure timeline

September 6, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute CVE-2026-65483 WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability CVE-2026-13440 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter CVE-2026-15393 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute