CVE-2023-0062: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-0062 affects the EAN for WooCommerce plugin versions below 4.4.3. This security flaw was publicly disclosed on January 11, 2023, and involves a Stored Cross-Site Scripting (XSS) vulnerability that affects users with contributor-level permissions and above (WPScan).

The vulnerability stems from the plugin's failure to properly validate and escape shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The vulnerability has been assigned a CVSS score of 6.8 (medium severity) and is classified under CWE-79. A proof of concept exploit involves using the algwceanproductimage shortcode with malicious attributes (WPScan).

When exploited, this vulnerability allows attackers with contributor-level access or higher to perform Stored Cross-Site Scripting attacks on the affected WordPress installations. This could potentially lead to the execution of malicious JavaScript code in users' browsers when viewing affected pages (WPScan).

The vulnerability has been fixed in version 4.4.3 of the EAN for WooCommerce plugin. Site administrators are advised to update to this version or later to mitigate the risk (WPScan).