CVE-2023-2812: 
WordPress vulnerability analysis and mitigation

CVE-2023-2812 is a security vulnerability discovered in the Ultimate Dashboard WordPress plugin versions before 3.7.6. The vulnerability was publicly disclosed on May 23, 2023, and was identified by researchers Ilyase Dehy and Aymane Mazguiti. The issue affects the plugin's settings functionality, specifically related to insufficient sanitization and escaping of certain settings parameters (WPScan Advisory).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS 3.1 Base Score of 4.8 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The technical issue stems from the plugin's failure to properly sanitize and escape certain settings, particularly in the plugin's general settings section. This vulnerability is tracked as CWE-79 (NVD Database).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is explicitly disallowed, such as in multisite WordPress setups. This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan Advisory).

The vulnerability has been fixed in version 3.7.6 of the Ultimate Dashboard plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan Advisory).