CVE-2023-50832: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Mondula GmbH's Multi Step Form WordPress plugin, tracked as CVE-2023-50832. The vulnerability affects versions up to and including 1.7.13 and was disclosed on December 19, 2023. The security issue was identified by researcher Benmalek Aymen (centaurus) (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 4.8 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which will be executed when guests visit the site. The stored nature of the XSS makes it particularly concerning as the malicious payload persists on the affected website (Patchstack).

The vulnerability requires high privileges for exploitation, indicating that an attacker would need administrator-level access to successfully exploit it. User interaction is also required for the exploit to be successful, as indicated by the CVSS metrics (NVD).

The vulnerability has been patched in version 1.7.17 of the Multi Step Form plugin. Users are advised to update to version 1.7.17 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).