CVE-2023-3372: 
WordPress vulnerability analysis and mitigation

The Lana Shortcodes WordPress plugin before version 1.2.0 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered in June 2023 and assigned CVE-2023-3372. The plugin fails to properly validate and escape shortcode attributes before outputting them back in pages or posts where the shortcode is embedded (WPScan, NVD).

The vulnerability stems from improper input validation and escaping of shortcode attributes in the plugin. It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability allows users with contributor role and above to perform Stored Cross-Site Scripting attacks. When successfully exploited, it enables attackers to inject malicious JavaScript code that executes in visitors' browsers when viewing affected pages (WPScan).

The vulnerability has been fixed in version 1.2.0 of the Lana Shortcodes plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).