CVE-2023-7083: 
WordPress vulnerability analysis and mitigation

The Voting Record WordPress plugin through version 2.0 contains a Cross-Site Request Forgery (CSRF) vulnerability combined with missing sanitization and escaping mechanisms. This vulnerability was discovered on December 10, 2022, and was assigned CVE-2023-7083. The issue affects all versions of the plugin up to and including version 2.0 (WPScan, NVD).

The vulnerability stems from the absence of CSRF protection mechanisms in certain areas of the plugin, coupled with inadequate input sanitization and output escaping. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

When successfully exploited, this vulnerability allows attackers to execute Stored Cross-Site Scripting (XSS) payloads through CSRF attacks, potentially compromising the security of the WordPress installation when an administrator is logged in (WPScan).

Currently, there is no known fix available for this vulnerability. Website administrators using the Voting Record plugin should consider either removing the plugin or implementing additional security measures to prevent CSRF attacks (WPScan).