CVE-2023-53916

Zenphoto 1.6 Stored Cross-Site Scripting via User Postal Code Field

Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.

Affected

Zenphoto

CVSS v4.0 VULNCHECK

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

4.6 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2025-12-17

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51485

Security advisories

• https://www.vulncheck.com/advisories/zenphoto-stored-cross-site-scripting-via-user-postal…
• https://www.zenphoto.org/news/zenphoto-1.6

References

• CVE Record
• NVD entry