CVE-2023-0420: 
WordPress vulnerability analysis and mitigation

The Custom Post Type and Taxonomy GUI Manager WordPress plugin version 1.1 and below contains a stored Cross-Site Scripting (XSS) vulnerability via Cross-Site Request Forgery (CSRF). This vulnerability was discovered and publicly disclosed on March 28, 2023, by security researcher Shreya Pohekar (WPScan).

The vulnerability stems from the plugin's lack of CSRF protection and insufficient sanitization and escaping of certain parameters. The issue has been assigned a CVSS score of 7.5 (High) and is classified under CWE-79. The vulnerability affects the custom-post-type-cpt-cusom-taxonomy-ct-manager plugin and can be triggered in the dashboard for users with Contributor privileges and above (WPScan).

When successfully exploited, this vulnerability allows attackers to execute stored Cross-Site Scripting payloads through CSRF attacks. The attack requires a logged-in administrator to open a specially crafted page, after which the XSS payload becomes persistent in the dashboard (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Users of the affected plugin should consider either removing the plugin or implementing additional security controls to prevent unauthorized access to the affected functionality (WPScan).