CVE-2023-0375: 
WordPress vulnerability analysis and mitigation

The Easy Affiliate Links WordPress plugin before version 3.7.1 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-0375. The vulnerability was discovered on December 14, 2022, and publicly disclosed on January 24, 2023. This security issue affects WordPress installations using the Easy Affiliate Links plugin versions prior to 3.7.1 (WPScan).

The vulnerability stems from the plugin's failure to properly validate and escape certain block options before outputting them back in a page or post where the block is embedded. The vulnerability has been assigned a CVSS score of 6.8 (medium severity). The issue specifically affects the 'Additional CSS class(es)' field in the Easy Affiliate Link Gutenberg block (WPScan).

This vulnerability allows authenticated users with contributor-level access or higher to perform Stored Cross-Site Scripting attacks. When successfully exploited, attackers can inject malicious JavaScript code that executes when other users view the affected pages (WPScan).

The vulnerability has been patched in version 3.7.1 of the Easy Affiliate Links plugin. Website administrators are advised to update to this version or later to mitigate the security risk (WPScan).