CVE-2023-6923: 
NixOS vulnerability analysis and mitigation

The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability via the idsite parameter in versions up to and including 4.15.3. The vulnerability was disclosed on February 28, 2024 (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the plugin's handling of the idsite parameter. The issue has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The successful exploitation could lead to the exposure of sensitive information or potential manipulation of user interactions within the WordPress site (NVD).

The vulnerability can be exploited by unauthenticated attackers who can craft malicious URLs containing XSS payloads. The attack requires user interaction, such as clicking on a specially crafted link, to execute the malicious script (NVD).

Users should update their Matomo Analytics WordPress plugin to a version newer than 4.15.3 to address this vulnerability (NVD).