CVE-2023-1119: 
WordPress vulnerability analysis and mitigation

CVE-2023-1119 affects multiple WordPress plugins including WP-Optimize (versions before 3.2.13) and SrbTransLatin (versions before 2.4.1). The vulnerability was discovered by Paolo Elia and publicly disclosed on June 19, 2023. The issue stems from a third-party library implementation that incorrectly handles HTML character escaping (WPScan Details).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS score of 7.1 (high severity). It is categorized under OWASP Top 10 as A7: Cross-Site Scripting (XSS) and mapped to CWE-79. The core issue lies in a third-party library that removes the escaping on some HTML characters, potentially allowing malicious script injection (WPScan Details).

The vulnerability enables cross-site scripting attacks through both reflected and stored XSS vectors. In WP-Optimize, attackers can execute reflected XSS through the image settings page, while in SrbTransLatin, authenticated users with contributor-level access can perform stored XSS attacks through post content (WPScan Details).

The vulnerability has been patched in WP-Optimize version 3.2.13 and SrbTransLatin version 2.4.1. Users are advised to update their plugins to these or later versions to mitigate the risk (WPScan Details).