CVE-2023-5413: 
WordPress vulnerability analysis and mitigation

The Image horizontal reel scroll slideshow plugin for WordPress (CVE-2023-5413) contains a Stored Cross-Site Scripting vulnerability via the 'ihrss-gallery' shortcode in versions up to and including 13.3. The vulnerability was disclosed on December 18, 2023, and affects the WordPress plugin developed by Gopiplus (NVD CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the 'ihrss-gallery' shortcode. The severity is rated as MEDIUM with a CVSS v3.1 Base Score of 5.4 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD CVE).

When exploited, this vulnerability allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD CVE).

The vulnerability requires an authenticated user with contributor-level or higher permissions to exploit. The attack complexity is considered Low, requiring user interaction for successful exploitation (NVD CVE).

Users should update their Image horizontal reel scroll slideshow plugin to a version newer than 13.3. A patch has been released to address this vulnerability (WordPress Plugin).