CVE-2023-0431: 
WordPress vulnerability analysis and mitigation

The File Away WordPress plugin through version 3.9.9.0.1 contains a security vulnerability identified as CVE-2023-0431. The vulnerability was discovered by István Márton and publicly disclosed on May 16, 2023. This security issue affects WordPress installations using the File Away plugin version 3.9.9.0.1 or earlier (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes in the File Away plugin. This security flaw has been classified as a Stored Cross-Site Scripting (XSS) vulnerability with a CVSS score of 6.8 (medium severity). The technical issue specifically relates to the fileup shortcode attribute which can be manipulated to execute malicious JavaScript code (WPScan).

The vulnerability allows users with privileges as low as contributor level to perform Stored Cross-Site Scripting attacks. When successfully exploited, attackers can inject and execute malicious JavaScript code that will be stored on the target site and executed in visitors' browsers (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Website administrators using the File Away plugin should consider either removing the plugin or restricting access to users who need to use the plugin's functionality (WPScan).