CVE-2023-52216 is a medium severity (4.3) cross-site request forgery in the JS and CSS Script Optimizer WordPress plugin, affecting version 0.3.3 and earlier. Patchstack lists no official patch. Remove the plugin or replace it with a maintained alternative, and deactivate it in the meantime.
What's affected
The NVD record names Yevhen Kotelnytskyi and the JS and CSS Script Optimizer plugin for WordPress, from the earliest release through 0.3.3. Patchstack shows no official patch for this plugin. I could not confirm a fixed version, so check the plugin page and developer for a release newer than 0.3.3.
The weakness is CWE-352, cross-site request forgery. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, which gives 4.3 (Medium).
Patchstack lists the required privilege as unauthenticated. The attacker needs no account, but a logged in user must be tricked into a request. The vector shows user interaction required, and the effect is a low integrity change.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get js-css-script-optimizer
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 0.3.3 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Deactivate JS and CSS Script Optimizer, then delete it if you can live without it.
- If you need the function, look for a maintained plugin that does the same job, and test it before switching.
- Review recent activity: check the plugin settings for options you do not recognise.
- If you must keep it for now, restrict access with your host or a web application firewall rule and set a date to remove it.
Why it matters
Cross-site request forgery works because the browser attaches the visitor's login cookie to any request sent to your site, including one triggered from a page the attacker controls. If a plugin accepts a state changing request without checking a secret token, the request is treated as a deliberate action by the logged in user.
The attack needs a person with the right privileges to be lured into visiting a page or clicking a link, which is why the score is modest. It is still worth closing, because administrators browse the web while logged in to their sites. The effect is a low integrity change to plugin settings. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Quick check
What can CVE-2023-52216 change?
The vector rates the effect as a low integrity change and nothing else. The record does not describe which setting is affected, so check the plugin options for anything unexpected.
Is there a patched version?
Not according to Patchstack, which shows no official patch at the time of writing. Check the developer's plugin page for anything newer than 0.3.3 before you decide.
Sources
Last reviewed: 19 October 2026.
