CVE-2023-0097: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-0097 affects the WordPress plugin Post Grid, Post Carousel, & List Category Posts versions prior to 2.4.19. This security issue was publicly disclosed on January 6, 2023, and involves a Stored Cross-Site Scripting (XSS) vulnerability that affects users with contributor roles and above (WPScan).

The vulnerability stems from the plugin's failure to validate and escape certain block options before outputting them back in a page/post where the block is embedded. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-79. The issue specifically affects the 'Smart Post Show' Gutenberg block's Additional CSS classes functionality (WPScan).

When exploited, this vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in users' browsers who view the affected pages (WPScan).

The vulnerability has been fixed in version 2.4.19 of the Post Grid, Post Carousel, & List Category Posts plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).