CVE-2023-5663: 
WordPress vulnerability analysis and mitigation

The News Announcement Scroll plugin for WordPress was found to contain a SQL Injection vulnerability (CVE-2023-5663) in versions up to and including 9.0.0. The vulnerability was discovered by István Márton and was disclosed in March 2024. The issue affects the plugin's shortcode functionality due to insufficient escaping of user input (Wordfence, NVD).

The vulnerability has been assigned a CVSS score of 8.8, indicating a high severity level. The SQL injection vulnerability exists in the plugin's shortcode implementation, where user input is not properly escaped before being used in database queries (Wordfence).

A successful exploitation of this vulnerability could allow authenticated users with Contributor level permissions or higher to perform SQL injection attacks, potentially leading to unauthorized access to or manipulation of the WordPress database.

The vulnerability requires authentication with at least Contributor-level access to exploit, which somewhat limits its potential impact. However, the high CVSS score suggests that exploitation could be straightforward for authenticated users (Wordfence).

Website administrators running the News Announcement Scroll plugin should update to a version newer than 9.0.0 as soon as possible to address this vulnerability.