CVE-2023-51677: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Magazine3 Schema & Structured Data for WP & AMP WordPress plugin, identified as CVE-2023-51677. The vulnerability was discovered by researcher LVT-tholv2k and publicly disclosed on December 27, 2023. This security issue affects versions up to and including 1.23 of the plugin (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. The plugin fails to properly sanitize and escape certain parameters, which could lead to stored XSS attacks. The vulnerability has received multiple CVSS scores: NIST assigned a CVSS v3.1 base score of 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack rated it at 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD, WPScan).

The vulnerability could allow users with privileges as low as Contributor to perform Cross-Site Scripting attacks. If exploited, this could enable malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which would be executed when visitors access the site (Patchstack).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 1.24 of the Schema & Structured Data for WP & AMP plugin. Users are advised to update to version 1.24 or later to remediate the vulnerability. Patchstack users have the option to enable auto-updates for vulnerable plugins (Patchstack).