CVE-2023-50369: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the Alma – Pay in installments or later for WooCommerce plugin, identified as CVE-2023-50369. The vulnerability affects versions through 5.1.3 of the plugin and was initially reported on September 19, 2023, with public disclosure occurring on December 7, 2023. The vulnerability was discovered by Ngô Thiên An (ancorn_ from VNPT-VCI) (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) issue, categorized under CWE-79. It received a CVSS v3.1 base score of 5.4 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher CVSS score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which would be executed when visitors access the site. The impact is considered to have low severity and is unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 5.2.1 of the plugin. Users are advised to update to version 5.2.1 or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).