CVE-2023-6161: 
WordPress vulnerability analysis and mitigation

CVE-2023-6161 affects the WP Crowdfunding WordPress plugin versions before 2.1.9. The vulnerability was discovered and publicly disclosed on December 13, 2023. The issue stems from the plugin's failure to properly sanitize and escape a parameter before outputting it back in the page (WPScan).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has been assigned a CVSS score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability can be triggered through the Campaign Search widget functionality (WPScan, NVD).

The vulnerability could be exploited against high-privilege users such as administrators. When successfully exploited, it allows an attacker to execute arbitrary JavaScript code in the context of the targeted user's browser session (WPScan).

The vulnerability has been fixed in version 2.1.9 of the WP Crowdfunding plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).