CVE-2023-25023: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Saleswonder.Biz Webinar ignition WordPress plugin versions 2.14.2 and below. The vulnerability was assigned CVE-2023-25023 and was first reported on February 3, 2023. This security issue affects authenticated users with administrative privileges (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 4.8 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a slightly higher CVSS score of 5.9 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow a malicious actor with administrative access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires an authenticated user with administrative privileges to exploit, which significantly reduces its risk. It has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 2.14.3 of the WebinarIgnition plugin. Users are advised to update to version 2.14.3 or later to remove the vulnerability (Patchstack).