CVE-2023-28664: 
WordPress vulnerability analysis and mitigation

The Meta Data and Taxonomies Filter WordPress plugin, versions prior to 1.3.1, contains a reflected cross-site scripting vulnerability (CVE-2023-28664). The vulnerability exists in the 'taxname' parameter of the mdfgettaxoptionsinwidget action and can only be exploited by authenticated users (Tenable Research, WPScan).

The vulnerability stems from incorrect usage of the core function 'eschtml_' which leads to a reflected XSS via the 'tax_name' parameter. The CVSS v3.1 score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires low attack complexity but needs user interaction and authenticated access (Tenable Research).

If successfully exploited, this vulnerability could allow authenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to theft of sensitive information or manipulation of the web interface (WPScan).

The vulnerability has been fixed in version 1.3.1 of the Meta Data and Taxonomies Filter WordPress plugin. Users are advised to update to this version or later to mitigate the risk (Tenable Research).