CVE-2023-6626: 
WordPress vulnerability analysis and mitigation

The Product Enquiry for WooCommerce WordPress plugin before version 3.1 contains a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists due to improper sanitization and escaping of some settings, which affects high privilege users such as administrators, even when the unfiltered_html capability is disallowed in multisite setups (WPScan).

The vulnerability is classified as a Stored XSS (CWE-79) with a CVSS 3.1 Base Score of 4.8 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue affects the Form Customizer and Translate sections of the plugin's admin interface, where unsanitized input can be stored and later executed (NVD, WPScan).

The vulnerability allows authenticated administrators to perform Stored Cross-Site Scripting attacks. While this requires high privileges, it can bypass security restrictions typically enforced in multisite WordPress installations, particularly the unfiltered_html capability limitation (WPScan).

The vulnerability has been fixed in version 3.1 of the Product Enquiry for WooCommerce plugin. Users should update to this version or later to mitigate the risk (WPScan).