CVE-2023-1905: 
WordPress vulnerability analysis and mitigation

CVE-2023-1905 affects the WP Popups WordPress plugin versions below 2.1.5.1. The vulnerability was discovered and publicly disclosed on April 17, 2023, and was subsequently patched in version 2.1.5.1. This security issue affects WordPress installations using the vulnerable plugin versions (WPScan).

The vulnerability is a Stored Cross-Site Scripting (XSS) issue that occurs due to improper escaping of the href attribute in the spu-facebook-page shortcode. The plugin fails to properly sanitize this attribute before outputting it back in a page or post where the shortcode is embedded. This vulnerability was introduced as a result of an insufficient fix for a previous vulnerability (CVE-2023-24003). The CVSS score for this vulnerability is 6.8 (medium severity) (WPScan).

The vulnerability allows users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. When exploited, the XSS payload is triggered when users click on the affected link in pages where the malicious shortcode is embedded (WPScan).

The vulnerability has been fixed in WP Popups version 2.1.5.1. Users are advised to update to this version or later to mitigate the risk (WPScan).