CVE-2023-2178: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2023-2178) affects the Aajoda Testimonials WordPress plugin versions below 2.2.2. The issue is a Stored Cross-Site Scripting (XSS) vulnerability that allows high-privilege users such as administrators to perform XSS attacks, even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

The vulnerability stems from improper sanitization and escaping of plugin settings in the Aajoda Testimonials plugin. The issue has been assigned a CVSS score of 3.4 (Low) and is classified under CWE-79. The vulnerability was discovered by Juampa Rodríguez and was publicly disclosed on June 5, 2023 (WPScan).

When exploited, this vulnerability allows administrators to store and execute malicious JavaScript code through the plugin's settings, potentially affecting other users who access the affected pages. This is particularly concerning in multisite WordPress installations where unfiltered HTML is typically restricted (WPScan).

The vulnerability has been fixed in version 2.2.2 of the Aajoda Testimonials plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).