CVE-2023-4315: 
WordPress vulnerability analysis and mitigation

The Woo Custom Emails WordPress plugin (versions up to and including 2.2) contains a Reflected Cross-Site Scripting vulnerability (CVE-2023-4315) discovered in August 2023. The vulnerability exists in the wcemails_edit parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability stems from improper input validation and output escaping in the wcemails_edit parameter of the plugin (Wordfence).

When exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The successful exploitation could lead to theft of sensitive information or manipulation of the user's browser session (NVD).

Users should update to a version newer than 2.2 of the Woo Custom Emails plugin. The vulnerability has been patched in the source code, as evidenced by the fix in the plugin's repository (WordPress Plugin).