CVE-2023-23806: 
WordPress vulnerability analysis and mitigation

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability affects Davinder Singh Custom Settings plugin versions 1.0 and below for WordPress. The vulnerability was discovered on January 10, 2023, and publicly disclosed on February 20, 2023 (Patchstack).

The vulnerability exists because the plugin does not properly sanitize and escape some of its settings, which could allow high privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N according to NVD, while Patchstack rates it at 5.9 (MEDIUM) (WPScan, NVD).

The vulnerability could allow malicious actors with administrative privileges to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

Currently, there is no official fix available for this vulnerability in the WordPress Custom Settings plugin (Patchstack).