CVE-2023-7015: 
WordPress vulnerability analysis and mitigation

The File Manager Pro plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2023-7015) via the 'tb' parameter in versions up to and including 8.3.4. The vulnerability was discovered due to insufficient input sanitization and output escaping in the plugin (NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.1 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires user interaction (UI:R), has a changed scope (S:C), and can result in low confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N) (Wordfence).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The scripts would run in the context of the victim's browser session (NVD).

The vulnerability can be exploited by unauthenticated attackers who can trick users into performing specific actions. The attack requires user interaction, such as clicking on a specially crafted link (NVD).

Users should update the File Manager Pro plugin to a version newer than 8.3.4 to address this vulnerability. The fix has been implemented in subsequent versions as noted in the changelog (File Manager Changelog).