CVE-2023-52178: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in MojofyWP's WP Affiliate Disclosure WordPress plugin, identified as CVE-2023-52178. The vulnerability affects versions up to and including 1.2.7 of the plugin, allowing for Stored XSS attacks. The issue was discovered and reported by resecured.io on November 29, 2023, and was publicly disclosed on December 29, 2023 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It received a CVSS v3.1 base score of 6.5 (Medium) from Patchstack with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, while the NVD assigned a slightly lower score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires Contributor or higher privileges to exploit (Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability has been patched in version 1.2.8 of the WP Affiliate Disclosure plugin. Users are advised to update to version 1.2.8 or later to remediate the security issue (Patchstack).