CVE-2023-2578: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-2578 affects the Buy Me a Coffee WordPress plugin versions below 3.7. It was discovered and publicly disclosed on June 19, 2023. The vulnerability is a Stored Cross-Site Scripting (XSS) issue that affects high-privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. The issue has been classified as XSS (CWE-79) with a CVSS score of 3.5 (low severity). The vulnerability specifically affects multiple admin settings in the plugin's widget customization and button customization features (WPScan).

When exploited, this vulnerability allows high-privilege users to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite setups where the unfiltered_html capability is typically disallowed for security reasons (WPScan).

The vulnerability can be exploited through two main vectors: the widget customization feature where XSS payloads can be injected into description or Widget message parameters, and the button customization settings where payloads can bypass the maxlength check on the text parameter (WPScan).

The vulnerability has been fixed in version 3.7 of the Buy Me a Coffee WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).