CVE-2023-5708: 
WordPress vulnerability analysis and mitigation

CVE-2023-5708 affects the WP Post Columns plugin for WordPress in all versions up to and including 2.2. The vulnerability was discovered and reported by István Márton from Wordfence, with public disclosure on October 22, 2023 (Wordfence Advisory).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that exists in the plugin's 'column' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability has received a CVSS v3.1 base score of 6.4 (Medium) from Wordfence and 5.4 (Medium) from NVD, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD Database).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially compromising the security of site visitors (NVD Database).

A patch has been released to address this vulnerability. Website administrators are advised to update their WP Post Columns plugin to a version newer than 2.2 (WordPress Plugin).