CVE-2023-48321: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the AMP for WP – Accelerated Mobile Pages WordPress plugin, identified as CVE-2023-48321. The vulnerability affects versions through 1.0.88.1 of the plugin, developed by Ahmed Kaludi and Mohammed Kaludi. This security issue was disclosed on November 30, 2023, and allows for Stored XSS attacks (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 5.4 (MEDIUM) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a slightly higher CVSS score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows attackers to inject malicious scripts into the website, which can be executed when visitors access the affected pages. This could lead to potential redirects, unauthorized advertisements, and other malicious HTML payloads being executed in visitors' browsers (Patchstack).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. It was initially reported by Ngô Thiên An (ancorn_ from VNPT-VCI) on September 6, 2023 (Patchstack).

Users are advised to update to version 1.0.89 or later to remediate this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).