CVE-2023-5005: 
WordPress vulnerability analysis and mitigation

CVE-2023-5005 affects the Autocomplete Location field Contact Form 7 WordPress plugin before version 3.0 and autocomplete-location-field-contact-form-7-pro WordPress plugin before version 2.0. The vulnerability was discovered and reported by Bob Matyas, and was publicly disclosed on November 21, 2023 (WPScan Advisory).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79. The vulnerability exists because the plugin does not properly sanitize and escape some of its settings. It has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD Database).

The vulnerability could allow high privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setup configurations (WPScan Advisory).

The vulnerability has been fixed in version 3.0 of the Autocomplete Location field Contact Form 7 plugin and version 2.0 of the pro version. Users are advised to update to these versions or later to mitigate the vulnerability (WPScan Advisory).