CVE-2023-41425: Wonder CMS installModule XSS leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityPublic exploit code and a very high EPSS score make exploitation likely, and the stated outcome is arbitrary code execution despite the medium CVSS base score.

What it is

Wonder CMS versions 3.2.0 through 3.4.2 contain a cross-site scripting flaw in the installModule component, where a crafted script can be uploaded. The CVSS vector notes scope change and low confidentiality and integrity impact, but the description states the flaw allows a remote attacker to execute arbitrary code, which raises the stakes beyond a typical reflected XSS.

Impact

An attacker can run arbitrary code on the server hosting Wonder CMS, not just script in a victim's browser. That can lead to full compromise of the site and any data or credentials it holds.

Attack surface

The vulnerability is network reachable (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), meaning a victim must trigger the crafted upload or view the malicious content. The installModule component is the entry point.

Exploitation

Public exploit code exists in the referenced gists and Exploit-DB entry, and EPSS is high at 0.543 (99th percentile), though CISA KEV does not list it. No ransomware use is documented.

What to do

• Upgrade Wonder CMS to a version later than 3.4.2 if one is available; the record does not name a fixed version.
• Restrict or disable the installModule functionality if it is not needed in production.
• Require authentication and strong access controls for any module installation or upload features.
• Deploy a web application firewall rule to block script uploads or suspicious installModule requests.
• Audit the server for unexpected files or processes that may indicate prior compromise.

Detection

• Monitor web server logs for POST requests to installModule paths with unusual file uploads or script content.
• Alert on new or modified files in web-accessible directories, especially those containing script tags or executable code.
• Use file integrity monitoring on the Wonder CMS installation directory.
• Review outbound network connections from the web server for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.