CVE-2023-53910: Wbce CMS

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script content in the content parameter to execute JavaScript when users view the affected page.

Affected products

• Wbce Wbce CMS: version 1.6.1 only

Published 2025-12-17. Last modified 2026-06-17.