CVE-2023-25979: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2023-25979) affects the Video Gallery by Total-Soft Video Gallery WordPress plugin versions 1.7.6 and below. It is an authenticated Stored Cross-Site Scripting (XSS) vulnerability that requires administrator-level access to exploit (Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue (CWE-79) that occurs due to insufficient sanitization and escaping of certain plugin settings. This vulnerability could be exploited even when the unfiltered_html capability is disallowed, such as in multisite setups. The CVSS v3.1 base score is 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This could potentially lead to the injection of malicious scripts that would be executed when other users visit the affected pages (Patchstack).

The vulnerability has been fixed in version 1.7.7 of the Video Gallery plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).