CVE-2023-6527: 
WordPress vulnerability analysis and mitigation

The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (CVE-2023-6527) via the HTTP_REFERER header in versions up to and including 1.2.18. This vulnerability was discovered and reported by Wordfence, with a CVSS v3.1 base score of 6.1 (Medium) (Wordfence Advisory).

The vulnerability stems from insufficient input sanitization and output escaping of the HTTP_REFERER header in the Email Subscription Popup WordPress plugin. The issue has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (NVD Database).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The impact is rated as low for both confidentiality and integrity, with no impact on availability (NVD Database).

The vulnerability has been patched in version 1.2.19 of the Email Subscription Popup plugin. Users are advised to update to this version or later to mitigate the risk (WordPress Patch).