CVE-2023-41797: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Gold Plugins Locations plugin versions 4.0 and below for WordPress. The vulnerability was identified on September 1, 2023, and was assigned CVE-2023-41797. This security issue affects users with contributor-level permissions and above (Patchstack).

The vulnerability stems from improper validation and escaping of certain parameters in the plugin. It has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) by NVD with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it at 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD, WPScan).

The vulnerability allows authenticated users with contributor-level access or higher to perform Stored Cross-Site Scripting attacks. This could enable malicious actors to inject harmful scripts, including redirects, advertisements, and other HTML payloads that execute when visitors access the affected site (Patchstack).

Currently, there is no official fix available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available (Patchstack).