TI-2023-05162 Aliases CVE-2023-5609 GHSA-4rfx-692g-gc7w

Seraphinite Accelerator < 2.20.29 - Reflected XSS

LOW 28CWE-79Published 2023-11-20 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Why it matters now

EPSS 0.00514 44th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Seraphinite Accelerator (Unknown): 2.2.29

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Seraphinite Accelerator	before 2.2.29	2.2.29	Patch available	CNA

Seraphinite Accelerator VendorUnknown Affected before 2.2.29 Fixed in 2.2.29 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:s-sols:seraphinite_accelerator::::::wordpress::*	before 2.2.29	Vulnerable	Seraphinite Solutions

cpe:2.3:a:s-sols:seraphinite_accelerator:*:*:*:*:*:wordpress:*:* Versions before 2.2.29 Vulnerable ·Seraphinite Solutions

Remediation

Fix · CNA Seraphinite Accelerator (Unknown) Fixed in 2.2.29

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-11-20
Seraphinite Accelerator 2.2.29
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-05163 Seraphinite Accelerator < 2.20.29 - Authenticated Arbitrary RedirectPriority LOW 25
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-5609
2026-10-03 Alias added: GHSA-4rfx-692g-gc7w

References

Exploit 1

https://wpscan.com/vulnerability/aac4bcc8-b826-4165-aed3-f422dd178692

TI-2023-27150 WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
TI-2026-02642 Information disclosure in seraphinitesoft Seraphinite Accelerator CVSS 3.1MEDIUM 6.5
TI-2024-01464 Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck CVSS 3.1MEDIUM 6.4
TI-2023-05163 Seraphinite Accelerator < 2.20.29 - Authenticated Arbitrary Redirect CVSS 3.1MEDIUM 5.4
TI-2023-05164 Seraphinite Accelerator < 2.20.32 - Unauthorised Settings Reset/Import CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences