CVE-2023-0364: 
WordPress vulnerability analysis and mitigation

CVE-2023-0364 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin real.Kit versions below 5.1.1. The vulnerability was discovered and publicly disclosed on February 21, 2023, by security researcher Lana Codes (WPScan).

The vulnerability exists because the plugin fails to properly validate and escape certain shortcode attributes before outputting them back in a page or post where the shortcode is embedded. This vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-79. The issue specifically affects users with contributor role and above, allowing them to perform Stored Cross-Site Scripting attacks (WPScan).

When exploited, this vulnerability allows authenticated users with contributor privileges or higher to inject malicious JavaScript code into pages or posts. This injected code would then execute in the browsers of any users who view the affected content, potentially leading to session hijacking, defacement, or theft of sensitive information (WPScan).

The vulnerability can be exploited by using specially crafted shortcode attributes. A proof of concept demonstrates the exploitation using the modal shortcode with malicious attributes: [modal open='1' class='" onmouseover="alert(1)" style="background:red;"']XSS[/modal] (WPScan).

The vulnerability has been fixed in version 5.1.1 of the real.Kit plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).