CVE-2023-7063: 
WordPress vulnerability analysis and mitigation

The WPForms Pro plugin for WordPress was found to contain a Stored Cross-Site Scripting vulnerability (CVE-2023-7063) affecting all versions up to and including 1.8.5.3. The vulnerability was discovered and disclosed on January 19, 2024 (Wordfence Advisory).

The vulnerability stems from insufficient input sanitization and output escaping in form submission parameters. The CVSS v3.1 base score is 6.1 (Medium) according to NVD assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), while Wordfence rated it at 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (NVD Details).

This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. This could lead to potential client-side attacks against site visitors and administrators (NVD Details).

The vulnerability can be exploited by unauthenticated attackers through form submission parameters, requiring no special privileges or user interaction according to the Wordfence assessment (Wordfence Advisory).

The vulnerability has been patched in version 1.8.5.4, released on December 27, 2023. Users are advised to update to this version or later to mitigate the risk (WPForms Changelog).