CVE-2023-0535: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-0535 affects the WordPress plugin 'Donation Block For PayPal' versions prior to 2.1.0. The vulnerability was discovered and publicly disclosed on February 1, 2023, by security researcher Lana Codes (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 6.8 (medium). The security flaw exists because the plugin fails to properly validate and escape certain shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The vulnerability is categorized as CWE-79 and falls under the OWASP Top 10 category A7: Cross-Site Scripting (WPScan).

This vulnerability allows users with contributor-level permissions or higher to perform Stored Cross-Site Scripting attacks. When successfully exploited, attackers can inject malicious JavaScript code that executes in visitors' browsers when viewing affected pages (WPScan).

A proof of concept exploit has been published, demonstrating the vulnerability using the payload: [paypal_donation_block size='" onmouseover="alert(1)"']. The exploit requires an authenticated user with at least contributor-level access to the WordPress installation (WPScan).

The vulnerability has been fixed in version 2.1.0 of the Donation Block For PayPal plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).