CVE-2023-51532: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Icegram Engage WordPress plugin (versions through 3.1.19). The vulnerability was identified on December 27, 2023, and affects the WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building functionality (Patchstack).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue due to improper neutralization of input during web page generation. It has received a CVSS v3.1 base score of 5.4 (Medium) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a score of 6.5 (Medium) (NVD).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability requires low attack complexity and low privileges (Contributor level) to exploit. User interaction is required for successful exploitation, and the scope is changed when exploited (NVD).

The vulnerability has been fixed in version 3.1.20 of the Icegram Engage plugin. Users are advised to update to version 3.1.20 or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).