CVE-2023-6624: 
WordPress vulnerability analysis and mitigation

The Import and export users and customers plugin for WordPress (CVE-2023-6624) contains a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 1.24.3. The vulnerability was discovered in December 2023 and was fixed in version 1.24.4 (WPScan, NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s). The CVSS v3.1 base score is 5.4 (Medium) according to NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attacker needs to have access to pages or posts where they can embed the plugin's shortcode (WPScan).

Users should update to version 1.24.4 or later of the Import and export users and customers plugin to address this vulnerability. The fix includes proper validation and escaping of shortcode attributes (WPScan).