CVE-2023-2578: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-2578 affects the Buy Me a Coffee WordPress plugin versions below 3.7. It was discovered and publicly disclosed on June 19, 2023. The vulnerability is a Stored Cross-Site Scripting (XSS) issue that affects high-privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. The issue has been classified as XSS (CWE-79) with a CVSS score of 3.5 (low severity). The vulnerability specifically affects multiple admin settings in the plugin's widget customization and button customization features (WPScan).

When exploited, this vulnerability allows high-privilege users to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite setups where the unfiltered_html capability is typically disallowed for security reasons (WPScan).

The vulnerability has been fixed in version 3.7 of the Buy Me a Coffee WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).