CVE-2023-1110: 
WordPress vulnerability analysis and mitigation

CVE-2023-1110 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Yellow Yard WordPress plugin versions below 2.8.12. The vulnerability was discovered on February 7, 2023, and affects users with contributor role and above. The issue was fixed in version 2.8.12 of the plugin (WPScan).

The vulnerability stems from the plugin's failure to validate and escape certain shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The affected attributes include 'field', 'type', 'title' in the yy_filter shortcode, and 'class' and 'action' in the yy_filter_container shortcode. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-79 (WPScan).

This vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. When successfully exploited, it enables attackers to inject malicious JavaScript code that executes in other users' browsers when viewing the affected pages (WPScan).

A proof of concept exploit has been documented using the following payloads: [yy_filter field='" style=background-color:red onmouseover=alert(/XSS/)//''] and [yy_filter_container class='" style=background-color:red onmouseover=alert(/XSS/)//']. The vulnerability has been verified by security researchers (WPScan).

The vulnerability has been patched in Yellow Yard version 2.8.12. Users are advised to update their installations to this version or later to mitigate the security risk (WPScan).