CVE-2023-50825: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the WordPress iframe Shortcode plugin, identified as CVE-2023-50825. The vulnerability affects versions up to and including 2.0 of the plugin, allowing for Stored XSS attacks. The issue was initially reported on November 8, 2023, and was publicly disclosed on December 19, 2023 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L according to Patchstack's assessment, while NIST assigned a slightly lower score of 5.4 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. The issue remains unpatched, and no specific workarounds have been publicly documented (Wordfence).