CVE-2023-1021: 
WordPress vulnerability analysis and mitigation

CVE-2023-1021 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Amr Ical Events Lists versions 6.6 and earlier. The vulnerability was discovered by Shreya Pohekar and was publicly disclosed on April 4, 2023. The issue exists in the plugin's settings functionality where it fails to properly sanitize and escape input fields (WPScan).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS score of 3.5 (low severity) and is mapped to CWE-79. The security flaw exists in the plugin's General Options settings where input fields are not properly sanitized and escaped, allowing for the injection of malicious scripts. This vulnerability can be exploited even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. When successfully exploited, the attacker can inject and store malicious JavaScript code that executes when other users access the affected pages (WPScan).

The vulnerability requires authentication with administrative privileges to exploit. A proof of concept exists demonstrating that an attacker can inject malicious payload through the General Options input fields in the wp-admin/admin.php?page=manage_amr_ical page (WPScan).

At the time of disclosure, there was no known fix available for this vulnerability. Users of the affected plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).