CVE-2023-0086

CVE-2023-0086 affects the JetWidgets for Elementor plugin for WordPress, specifically versions up to and including 1.0.12. This vulnerability is a Cross-Site Request Forgery (CSRF) due to a lack of nonce validation in the save() function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, allowing them to modify plugin settings. This could enable SVG uploads, potentially leading to Cross-Site Scripting (XSS). The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in high integrity impact. While the EPSS score is very low, suggesting a low probability of exploitation, the FAUCET Risk Score is 35/100. Currently, there is no evidence of active exploitation, and no public exploit code is available for Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, aligning with the typical lack of attention for most CVEs.