CVE-2023-6005: 
WordPress vulnerability analysis and mitigation

The EventON WordPress plugin (versions before 4.5.5 and before 2.2.7) contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-6005. The vulnerability was discovered and publicly disclosed on January 10, 2024. The issue affects both the free and premium versions of the EventON plugin for WordPress (WPScan Advisory).

The vulnerability stems from improper sanitization and escaping of plugin settings, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed (such as in multisite setups). The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue is classified under CWE-116 (Improper Encoding or Escaping of Output) and CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD Database).

The vulnerability allows authenticated users with high privileges to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in the context of other users' browsers when they view affected content, even in environments where unfiltered HTML is explicitly disallowed (WPScan Advisory).

The vulnerability has been patched in EventON version 4.5.5 and EventON Lite version 2.2.7. Users are advised to update to these versions or later to mitigate the risk (WPScan Advisory).