CVE-2023-4502: 
WordPress vulnerability analysis and mitigation

The Translate WordPress with GTranslate WordPress plugin before version 3.0.4 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on August 30, 2023, and affects the plugin's settings functionality where certain parameters are not properly sanitized and escaped. This security issue is particularly concerning in multisite setups where even users with administrative privileges but without unfiltered_html capability could perform stored XSS attacks (WPScan Advisory).

The vulnerability has been assigned CVE-2023-4502 and received a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The security flaw stems from improper sanitization and escaping of multiple parameters in the plugin's settings. The vulnerability is classified as CWE-79 (Cross-site Scripting) (NVD Database).

When exploited, this vulnerability allows high-privilege users to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite WordPress installations where the unfiltered_html capability is typically disallowed for security reasons. The impact is rated as having low confidentiality and integrity impact, with no effect on availability (NVD Database).

The vulnerability has been patched in version 3.0.4 of the Translate WordPress with GTranslate plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan Advisory).