CVE-2023-0829

Plesk versions 17.0 through 18.0.31 carry a cross-site scripting flaw where a malicious subscription owner, a customer or an additional user, can plant a payload that fully compromises the server when an administrator later views a certain subscription-related page. It is stored XSS with a devastating endpoint: the attacker starts as a low-privileged tenant and ends with control of the hosting server once an admin's session executes the payload.

The important dynamic is the trust inversion in shared hosting: the attacker only needs a legitimate subscription, something customers are given by design, and then waits for an admin to look at the right page. That makes it very practical in multi-tenant environments where operators routinely review subscriptions, and Plesk's ubiquity on hosting panels makes it a known, worthwhile target. Full server compromise from a tenant account is a serious escalation.

Our angle is chaining and blast radius: on any shared Plesk box, we treat every subscription owner as a potential attacker and prioritize the patch on control panels where untrusted customers hold accounts. Where updating lags, we would tighten admin workflows around viewing untrusted subscriptions and watch for anomalous admin-session behavior, since the exploit hinges on that privileged view firing the payload.