CVE-2023-6497: 
WordPress vulnerability analysis and mitigation

The WordPress Simple Shopping Cart plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2023-6497) in versions up to and including 4.7.1. The vulnerability was discovered in the automatic redirect URL setting and was disclosed on January 26, 2024 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the automatic redirect URL setting. It has been assigned a CVSS v3.1 base score of 4.8 (Medium) by NVD with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a score of 4.4 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability affects multi-site installations and installations where unfiltered_html has been disabled. When exploited, it allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that will execute whenever a user accesses an injected page (NVD).

The vulnerability requires an authenticated attacker with administrator-level permissions to exploit. The attack complexity is considered low according to NVD's assessment, though user interaction is required for successful exploitation (NVD).

Users should update their WordPress Simple Shopping Cart plugin to a version newer than 4.7.1 to address this vulnerability (NVD).