CVE-2023-49158: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was identified in LadiPage LadiApp through version 4.4. The vulnerability stems from improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts into web pages (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is related to broken access control that can lead to XSS attacks (NVD, Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access and above to exploit the unprotected functionality. This could lead to unauthorized access to data, modification of data, or loss of data. Additionally, attackers can potentially inject malicious web scripts into the website (WPScan).

As of the latest reports, there is no official fix available for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available (Patchstack).