CVE-2023-0363: 
WordPress vulnerability analysis and mitigation

The vulnerability identified as CVE-2023-0363 affects the Scheduled Announcements Widget WordPress plugin versions below 1.0. This security flaw was publicly disclosed on March 20, 2023, and involves a Stored Cross-Site Scripting (XSS) vulnerability that affects users with contributor-level permissions and above (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes in the plugin. When these attributes are output back in a page or post where the shortcode is embedded, it creates a potential attack vector. The vulnerability has been classified as CWE-79 (Cross-site Scripting) with a CVSS score of 6.8, indicating medium severity (WPScan).

When exploited, this vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in users' browsers who view the affected pages (WPScan).

A proof of concept exists demonstrating the vulnerability. The exploit involves adding an announcement with malicious JavaScript code in the shortcode attributes. The specific exploit uses the scroll attribute with injected JavaScript code: [announcements scroll='" onmouseover="alert(1)" style="background:red;"'] (WPScan).

The vulnerability has been fixed in version 1.0 of the Scheduled Announcements Widget plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).