CVE-2023-23703: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Tyche Softwares Arconix Shortcodes WordPress plugin, affecting versions 2.1.7 and below. The vulnerability was reported on January 9, 2023, and publicly disclosed on April 24, 2023. This security issue affects users with contributor-level access and above (Patchstack).

The vulnerability stems from insufficient input validation and output escaping of shortcode attributes before they are output back in a page or post where the shortcode is embedded. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, though Patchstack rates it at 6.5 (MEDIUM). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD, WPScan).

This vulnerability allows authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to various attacks including redirects, unauthorized advertisements, and other malicious HTML payloads (Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. Patchstack has classified this as a low-priority issue that is unlikely to be exploited, though it still presents a security risk that should be addressed (Patchstack).

The vulnerability has been fixed in version 2.1.8 of the Arconix Shortcodes plugin. Site administrators are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).