CVE-2023-6808: 
WordPress vulnerability analysis and mitigation

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2023-6808) affecting all versions up to and including 1.0.93. The vulnerability was discovered and disclosed by Wordfence, with the initial report published on February 5, 2024 (Wordfence Advisory).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s). The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) according to the NVD assessment (NVD). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user sessions (NVD).

Users should immediately update their Amelia plugin to a version newer than 1.0.93. The vulnerability has been patched in subsequent releases. A fix has been implemented in the plugin's frontend events handling code (WordPress Plugin).