CVE-2023-5337: 
WordPress vulnerability analysis and mitigation

The Contact form Form For All WordPress plugin (CVE-2023-5337) contains a Stored Cross-Site Scripting vulnerability in versions up to and including 1.2. The vulnerability exists in the 'formforall' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L). The vulnerability affects the confidentiality and integrity of the system with low impact (C:L/I:L) (NVD).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack can be executed remotely through the network with low complexity (NVD).

Users should update to a version newer than 1.2 of the Contact form Form For All plugin to address this vulnerability (NVD).