CVE-2023-0066: 
WordPress vulnerability analysis and mitigation

The Companion Sitemap Generator WordPress plugin through version 4.5.1.1 contained a security vulnerability identified as CVE-2023-0066. The vulnerability was publicly disclosed on February 20, 2023, affecting the plugin's shortcode attribute handling functionality (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 6.8 (medium severity). The technical root cause stems from the plugin's failure to properly validate and escape shortcode attributes before outputting them back in a page or post where the shortcode is embedded. This vulnerability is categorized as CWE-79 and falls under the OWASP Top 10 category A7: Cross-Site Scripting (WPScan).

The vulnerability allows users with contributor-level permissions and above to perform Stored Cross-Site Scripting attacks. This means that malicious actors with appropriate access levels could inject malicious scripts into the website, potentially affecting other users who view the compromised pages (WPScan).

The vulnerability has been fixed in version 4.5.3 of the Companion Sitemap Generator plugin. Website administrators are advised to update to this version or later to mitigate the security risk (WPScan).