CVE-2023-26528: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the jinit9906 Shipyaari Shipping Management WordPress plugin versions 1.0 and below. The vulnerability was identified on February 18, 2023, and publicly disclosed on February 28, 2023. This security issue affects users with administrative privileges (Patchstack Advisory).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue (CWE-79) that occurs due to improper sanitization and escaping of certain parameters. The CVSS v3.1 base score is 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L according to Patchstack's assessment (Patchstack Advisory).

The vulnerability could allow malicious actors with administrative access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would then be executed when guests visit the affected site (Patchstack Advisory).

As of the latest reports, there is no official fix available for this vulnerability. Given the low severity impact and the requirement of administrative privileges, the vulnerability is considered to have minimal risk (Patchstack Advisory).