CVE-2023-0034: 
WordPress vulnerability analysis and mitigation

The JetWidgets For Elementor WordPress plugin before version 1.0.14 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly validate and escape shortcode attributes before outputting them back in pages or posts where the shortcode is embedded. This vulnerability was discovered in December 2022 and affects users with contributor role and above (WPScan).

The vulnerability exists in the shortcode handling functionality where attributes like 'bgposition' and 'bgsize' are not properly sanitized. For successful exploitation, at least one post must have a thumbnail image. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-79: Cross-Site Scripting (WPScan).

This vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. Successful exploitation could enable attackers to inject malicious JavaScript code that executes in visitors' browsers when viewing affected pages (WPScan).

The vulnerability has been fixed in version 1.0.14 of the JetWidgets For Elementor plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).