CVE-2023-7154: 
WordPress vulnerability analysis and mitigation

The Hubbub Lite (formerly known as Grow Social) WordPress plugin versions before 1.32.0 contains a security vulnerability related to improper sanitization and escaping of settings (NVD, WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 4.8 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue stems from insufficient sanitization and escaping of certain plugin settings, which could be exploited even when the unfiltered_html capability is disallowed, such as in multisite setups (NVD).

This vulnerability could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. The impact is particularly notable in multisite setups where even with restricted unfiltered_html capability, the vulnerability could still be exploited (WPScan).

The vulnerability can be exploited by accessing the Floating Sidebar page (/wp-admin/admin.php?page=dpsp-sidebar) after enabling the 'Floating Sidebar' feature and manipulating the 'Twitter Username' settings while enabling the 'Add Twitter Username to all tweets' option (WPScan).

Users should upgrade to Hubbub Lite version 1.32.0 or later to address this vulnerability (WPScan).