CVE-2023-49847: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Twinpictures Annual Archive WordPress plugin, affecting versions up to and including 1.6.0. The vulnerability was identified on December 6, 2023, by security researcher Ngô Thiên An (ancorn_) from VNPT-VCI (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received varying CVSS scores: NIST assigned a CVSS v3.1 base score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack rated it at 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the injected page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is network-accessible with low attack complexity, requiring user interaction for successful exploitation (Patchstack).

As of the latest reports, there is no official fix available for this vulnerability. The issue was classified as having a low priority for virtual patching by Patchstack (Patchstack).