CVE-2022-0210: 
WordPress vulnerability analysis and mitigation

The Random Banner WordPress plugin (versions up to and including 4.1.4) was identified with a Stored Cross-Site Scripting vulnerability (CVE-2022-0210). The vulnerability was discovered and disclosed on January 12, 2022, affecting WordPress installations where the plugin is active. This security issue specifically impacts multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled (CVE Mitre).

The vulnerability stems from insufficient escaping in the category parameter located in the ~/include/models/model.php file. This security flaw allows attackers with administrative user access to inject arbitrary web scripts into the system (NVD, WordPress Plugin).

When successfully exploited, this vulnerability allows attackers with administrative access to inject and execute arbitrary web scripts on affected WordPress installations. The impact is particularly significant for multi-site installations and sites where unfiltered_html is disabled, potentially compromising website security (Wordfence Advisory).

The vulnerability requires an attacker to have administrative user access to be exploitable. It specifically affects WordPress installations where the unfiltered_html capability is disabled, either in multi-site installations for administrators or in single-site installations (Github Exploit).

Website administrators running affected versions of the Random Banner WordPress plugin (4.1.4 or earlier) should update to the latest version of the plugin that contains the security fix (NVD).