CVE-2023-2304: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-2304 affects the WordPress plugin Favorites versions prior to 2.3.3. The vulnerability was publicly disclosed on May 30, 2023, and involves a Stored Cross-Site Scripting (XSS) vulnerability that can be exploited by users with contributor-level access or higher (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes in the Favorites plugin. When these attributes are output back into the page, they can be manipulated to inject malicious scripts. The vulnerability was discovered by researcher Lana Codes (WPScan).

This vulnerability allows users with contributor-level permissions to perform Stored Cross-Site Scripting attacks that could potentially affect higher-privileged users, including administrators. The stored nature of the XSS makes it particularly dangerous as the malicious scripts persist in the database and can affect multiple users over time (WPScan).

The vulnerability has been fixed in version 2.3.3 of the Favorites plugin. Site administrators are strongly advised to update to this version or later to protect against potential attacks (WPScan).