CVE-2023-6961: 
WordPress vulnerability analysis and mitigation

The WP Meta SEO plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2023-6961) affecting all versions up to and including 4.5.12. The vulnerability stems from insufficient input sanitization and output escaping of the 'Referer' header (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (High) by Wordfence and 6.1 (Medium) by NIST. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The issue allows unauthenticated attackers to inject arbitrary web scripts that execute when users access the affected pages (NVD).

When exploited, the vulnerability allows attackers to create rogue administrator accounts, insert backdoors, and set up tracking scripts. The PHP backdoors can be injected into both plugin and theme files, while the tracking scripts are designed to send HTTP GET requests containing host information to remote servers (Hacker News).

Site owners are advised to update their WP Meta SEO plugin to version 4.5.13 or later. Additionally, it's recommended to review installed plugins, apply the latest updates, and audit sites for signs of malware or the presence of suspicious administrator users (Hacker News).

Security researchers from Fastly, including Simran Khalsa, Xavier Stevens, and Matthew Mathur, have actively tracked and reported on the exploitation of this vulnerability. The security community has noted this vulnerability as part of a larger campaign targeting multiple WordPress plugins (SecurityWeek).