CVE-2023-0823

CVE-2023-0823 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Cookie Notice & Compliance for GDPR / CCPA WordPress plugin prior to version 2.4.7. This flaw stems from insufficient validation and escaping of shortcode attributes, allowing authenticated users with contributor roles or higher to inject malicious scripts. The vulnerability carries a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to low impact on confidentiality and integrity. The EPSS score is low, suggesting a minimal likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received no community discussion or media coverage, further indicating a low level of attention and perceived threat.