CVE-2023-0076: 
WordPress vulnerability analysis and mitigation

The Download Attachments WordPress plugin versions before 1.3 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-0076. The vulnerability was discovered on February 13, 2023, and affects users with contributor role and above (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes before they are output back in a page or post where the shortcode is embedded. This can be exploited using specially crafted shortcode attributes, such as [download-attachments container_class='" onmouseover="alert(1)"']. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-79 (WPScan).

Successful exploitation of this vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to client-side code execution in the context of other users' browsers who view the affected pages (WPScan).

The vulnerability has been fixed in version 1.3 of the Download Attachments plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).