CVE-2022-0210: 
WordPress vulnerability analysis and mitigation

The Random Banner WordPress plugin (versions up to and including 4.1.4) was identified with a Stored Cross-Site Scripting vulnerability (CVE-2022-0210). The vulnerability was discovered and disclosed on January 12, 2022, affecting WordPress installations where the plugin is active. This security issue specifically impacts multi-site installations where unfilteredhtml is disabled for administrators, and sites where unfilteredhtml is disabled (CVE Mitre).

The vulnerability stems from insufficient escaping in the category parameter located in the ~/include/models/model.php file. This security flaw allows attackers with administrative user access to inject arbitrary web scripts into the system (NVD, WordPress Plugin).

When successfully exploited, this vulnerability allows attackers with administrative access to inject and execute arbitrary web scripts on affected WordPress installations. The impact is particularly significant for multi-site installations and sites where unfiltered_html is disabled, potentially compromising website security (Wordfence Advisory).

Website administrators running affected versions of the Random Banner WordPress plugin (4.1.4 or earlier) should update to the latest version of the plugin that contains the security fix (NVD).