CVE-2023-5141: 
WordPress vulnerability analysis and mitigation

The BSK Contact Form 7 Blacklist WordPress plugin through version 1.0.1 contains a Reflected Cross-Site Scripting vulnerability identified as CVE-2023-5141. The vulnerability was discovered and publicly disclosed on November 13, 2023. The affected component is the WordPress plugin 'bsk-contact-form-7-blacklist' up to and including version 1.0.1 (WPScan).

The vulnerability exists because the plugin fails to properly sanitize and escape the 'inserted_count' parameter before outputting it back in the page. This vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability could be exploited against high-privilege users such as administrators. When successfully exploited, it allows attackers to execute arbitrary JavaScript code in the context of the targeted user's browser session, potentially leading to theft of sensitive information or manipulation of the admin interface (WPScan).

The vulnerability can be exploited by crafting a specific URL containing malicious JavaScript code in the 'inserted_count' parameter. An attacker would need to convince an authenticated administrator to click on a specially crafted URL targeting the plugin's admin page (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the BSK Contact Form 7 Blacklist WordPress plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).