CVE-2023-3645: 
WordPress vulnerability analysis and mitigation

The Contact Form Builder by Bit Form WordPress plugin before version 2.2.0 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on July 24, 2023, and affects the plugin's settings functionality where input fields are not properly sanitized and escaped (WPScan Advisory).

The vulnerability stems from improper input validation and sanitization in the plugin's settings. High privilege users, such as administrators, can perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows high-privilege users to inject malicious scripts into form input fields, which could potentially be executed when other users access the affected forms. This could lead to client-side attacks and potential compromise of user data (WPScan Advisory).

The vulnerability has been fixed in version 2.2.0 of the Contact Form Builder by Bit Form plugin. Users are advised to update to this version or later to mitigate the risk (WPScan Advisory).