CVE-2023-39308: 
WordPress vulnerability analysis and mitigation

CVE-2023-39308 is an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability affecting the UserFeedback Team User Feedback WordPress plugin versions 1.0.7 and below. The vulnerability was discovered by Revan Arifio and publicly disclosed on September 4, 2023. The issue has been fixed in version 1.0.8 (Patchstack).

The vulnerability exists in the feedback submission feature where the plugin fails to properly validate and sanitize user input before storing it in the database. The issue specifically occurs in the save_survey_response function within the plugin's frontend class, where submitted text from users is not properly filtered before being saved to the database. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (Patchstack).

This vulnerability allows unauthenticated attackers to inject malicious scripts into the website through the feedback submission form. When administrators view the submitted feedback in the admin dashboard, the malicious scripts are executed, potentially leading to cookie theft, information disclosure, or other client-side attacks (Medium Blog).

The recommended mitigation is to update the UserFeedback plugin to version 1.0.8 or later, which implements proper input sanitization using sanitize_text_field() function. The fix prevents malicious script injection by properly sanitizing user input before storing it in the database (Patchstack).