CVE-2023-0151: 
WordPress vulnerability analysis and mitigation

CVE-2023-0151 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the uTubeVideo Gallery WordPress plugin versions below 2.0.8. The vulnerability was discovered and publicly disclosed on January 17, 2023, by security researcher Lana Codes (WPScan).

The vulnerability occurs because the plugin fails to properly validate and escape certain shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified as CWE-79: Cross-Site Scripting (WPScan).

This vulnerability could allow users with contributor-level privileges and above to perform Stored Cross-Site Scripting attacks. When successfully exploited, attackers can inject malicious JavaScript code that executes in visitors' browsers when viewing affected pages (WPScan).

A proof of concept exploit has been published, demonstrating the vulnerability using the following shortcode: [utubevideo view='panel' id='" onmouseover="alert(1)" style="background:red;"']. The attack requires an authenticated user with at least contributor-level access to the WordPress installation (WPScan).

The vulnerability has been fixed in version 2.0.8 of the uTubeVideo Gallery plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).