CVE-2023-4772: 
NixOS vulnerability analysis and mitigation

The Newsletter plugin for WordPress (versions up to 7.8.9) contains a Stored Cross-Site Scripting vulnerability (CVE-2023-4772) discovered in September 2023. The vulnerability exists in the 'newsletter_form' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes (NVD, WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.4 (Medium) according to Wordfence, and 5.4 (Medium) according to NVD. The technical issue stems from the plugin's failure to properly validate and escape newsletter_form shortcode attributes before outputting them back in a page or post where the shortcode is embedded (WPScan).

This vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) (NVD).

The vulnerability has been patched in version 7.9.0 of the Newsletter plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).