CVE-2023-37388: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Sudipto Pratap Mahato Simple Light Weight Social Share WordPress plugin versions 2.0 and below. The vulnerability was identified on July 5, 2023, and was assigned CVE-2023-37388. The issue affects users with administrative privileges and above (Patchstack).

The vulnerability stems from the plugin's failure to properly validate and escape certain parameters, which could enable users with admin roles to perform Stored Cross-Site Scripting attacks, even in scenarios where the unfiltered_html capability is disabled, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L according to Patchstack's assessment (WPScan, NVD).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires an authenticated user with administrative privileges to exploit. It has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

As of the vulnerability disclosure, no official fix has been made available for this security issue (Patchstack).