CVE-2023-0064: 
WordPress vulnerability analysis and mitigation

The eVision Responsive Column Layout Shortcodes WordPress plugin through version 2.3 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-0064. The vulnerability was publicly disclosed on February 13, 2023, and affects users with contributor-level permissions and above (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes before they are output in pages or posts where the shortcode is embedded. The vulnerability has been assigned a CVSS score of 6.8 (medium severity) and is classified under CWE-79. A proof of concept exploit involves using malicious JavaScript code within the 'bscolumns' shortcode's class attribute (WPScan).

When exploited, this vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in the context of other users' browsers who view the affected pages (WPScan).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. A proof of concept exists demonstrating the exploitation using the 'bscolumns' shortcode with malicious JavaScript in the class attribute (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue in the eVision Responsive Column Layout Shortcodes plugin (WPScan).