CVE-2023-52195: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Posts to Page plugin, affecting versions up to and including 1.7. The vulnerability was identified on December 17, 2023, and publicly disclosed on January 3, 2024. This security issue, tracked as CVE-2023-52195, affects the Posts to Page plugin developed by Kerry James (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It has received a CVSS v3.1 base score of 5.4 (Medium) from NIST and 6.5 (Medium) from Patchstack. The vulnerability requires low attack complexity, low privileges (Contributor level), and user interaction for exploitation. The attack vector is network-based, and the scope is changed when exploited (NVD).

When exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

Currently, there is no official fix available for this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).