CVE-2023-45747: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Syed Balkhi WP Lightbox 2 WordPress plugin, affecting versions 3.0.6.5 and below. The vulnerability was identified on October 12, 2023, and tracked as CVE-2023-45747. This security issue affects users with administrative privileges and above (Patchstack, WPScan).

The vulnerability stems from the plugin's failure to properly validate and escape certain parameters, particularly in plugin settings. This could enable users with admin roles to perform Stored Cross-Site Scripting attacks, even in scenarios where the unfiltered_html capability is disabled, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (Patchstack).

The vulnerability allows malicious actors with administrative access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would then be executed when visitors access the affected site (Patchstack).

The vulnerability has been patched in version 3.0.6.6 of the WP Lightbox 2 plugin. Site administrators are advised to update to version 3.0.6.6 or later to remediate this security issue (Patchstack).