CVE-2022-0598: 
WordPress vulnerability analysis and mitigation

The Login with phone number WordPress plugin before version 1.3.8 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-0598. The vulnerability was discovered and reported on February 14, 2022. This security issue affects the plugin's settings functionality, specifically impacting WordPress installations using this plugin (WPScan, CVE Mitre).

The vulnerability stems from improper sanitization and escaping of plugin settings, which could enable Cross-Site Scripting (XSS) attacks. The issue is particularly concerning as it can be exploited even when the unfiltered_html capability is disabled. The vulnerability is classified as CWE-79 (Cross-site Scripting) (NVD CNA Status).

When exploited, this vulnerability allows high-privilege users to perform Cross-Site Scripting attacks through the plugin's settings interface. The attack vector specifically involves the Style Settings section, where malicious JavaScript code can be injected into fields such as the button border radius setting (WPScan).

The recommended mitigation is to update the Login with phone number plugin to version 1.3.8 or later, which contains the security fix for this vulnerability (CVE Mitre).