CVE-2023-25790: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2023-25790) affects the WoodMart WordPress theme versions below 7.1.2. It is an Unauthenticated Arbitrary Shortcode Injection vulnerability that was publicly disclosed on February 16, 2023. The vulnerability exists when the 'Display results from blog' settings is enabled, potentially allowing attackers to inject arbitrary shortcodes into the website (WPScan).

The vulnerability allows arbitrary shortcode injection when the 'Display results from blog' settings is enabled. This could lead to Reflected Cross-Site Scripting (XSS) when using a shortcode vulnerable to XSS. The vulnerability has been assigned a CVSS score of 7.5 (high) and is classified under the OWASP Top 10 category A1: Injection (WPScan, Patchstack).

The vulnerability could allow malicious actors to inject their own content into pages and posts of the website. This could potentially be abused to inject phishing pages into the affected website. The impact is considered to have a low severity despite the high CVSS score (Patchstack).

A proof of concept exploit exists that demonstrates the vulnerability when the 'Display results from blog' settings is enabled. The exploit involves using a specific URL pattern: https://example.com/?s=][vc_raw_html]PHNjcmlwdD5hbGVydChgRmVhclp6WnpgKTs8L3NjcmlwdD4=[/vc_raw_html][audio%20&post_type=product&product_cat=lighting (WPScan).

The vulnerability has been fixed in WoodMart theme version 7.1.2. Website administrators are advised to update to version 7.1.2 or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).