CVE-2023-52118: 
WordPress vulnerability analysis and mitigation

CVE-2023-52118 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP User Profile Avatar WordPress plugin versions up to and including 1.0. The vulnerability was discovered by Abu Hurayra and publicly disclosed on December 28, 2023. The issue affects the WP User Profile Avatar plugin's web page generation functionality due to insufficient input sanitization and output escaping (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.5 (Medium) from Patchstack and 5.4 (Medium) from NVD. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R) (NVD).

This vulnerability allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to session hijacking, defacement, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, making it relatively straightforward to exploit for attackers who meet the authentication requirements (Patchstack).

The vulnerability has been fixed in version 1.0.1 of the WP User Profile Avatar plugin. Users are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).