CVE-2023-47876: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Perfmatters WordPress plugin, affecting versions up to and including 2.1.6. The vulnerability was disclosed on November 21, 2023, and was assigned CVE-2023-47876. The issue stems from insufficient input sanitization and output escaping in the plugin (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 6.1 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a higher score of 7.1 (High) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could lead to the execution of malicious scripts, potential redirects, unwanted advertisements, and other HTML payloads on the affected website (Patchstack).

The vulnerability has been fixed in Perfmatters version 2.1.7. Users are advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).