CVE-2023-30782: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Church Admin plugin versions 3.7.5 and below. The vulnerability was identified on April 18, 2023, by security researcher Le Ngoc Anh and was assigned CVE-2023-30782. The vulnerability affects the Church Admin plugin for WordPress, developed by Andy Moyle (Patchstack).

The vulnerability stems from improper sanitization and escaping of certain parameters before they are output back to the page. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has received varying CVSS scores, with the NVD assigning a CVSS v3.1 Base Score of 6.1 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it at 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD, WPScan).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site, potentially impacting high-privilege users such as administrators (Patchstack).

The vulnerability has been fixed in version 3.7.6 of the Church Admin plugin. Users are advised to update to version 3.7.6 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to the fixed version (Patchstack).