CVE-2023-6082: 
WordPress vulnerability analysis and mitigation

The chartjs WordPress plugin through version 2023.2 contains a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed in January 2024, affecting the plugin's settings functionality. The issue stems from inadequate sanitization and escaping of certain settings parameters (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) with a CVSS v3.1 score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue specifically affects the plugin's settings functionality where certain parameters are not properly sanitized and escaped, particularly in the Font Family setting (NVD).

When exploited, this vulnerability could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is explicitly disallowed, such as in multisite WordPress setups (WPScan).

Currently, there is no known fix available for this vulnerability. Users should consider implementing additional security controls or limiting access to the plugin's settings until a patch is released (WPScan).