CVE-2023-53909: Wbce CMS

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the /wbce/modules/elfinder/ef/php/connector.wbce.php endpoint and execute JavaScript when victims access the uploaded file.

Affected products

• Wbce Wbce CMS: version 1.6.1 only

Published 2025-12-17. Last modified 2026-06-17.