CVE-2022-0700: 
WordPress vulnerability analysis and mitigation

The Simple Theme Options WordPress plugin versions before 1.7 contained a Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-0700. The vulnerability was discovered and publicly disclosed on February 21, 2022. This security issue affects the plugin's settings functionality, specifically impacting WordPress installations using the Simple Theme Options plugin (WPScan).

The vulnerability stems from improper sanitization and escaping of plugin settings. This security flaw exists even when the unfiltered_html capability is disallowed for high-privilege users. The vulnerability has been assigned a CVSS score of 3.4 (low severity) and is classified under CWE-79, which pertains to Cross-Site Scripting attacks (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Cross-Site Scripting attacks through the plugin's settings. The XSS payload can be triggered when accessing the Theme Customizer page (/wp-admin/customize.php), potentially affecting the security of the WordPress installation (WPScan).

The vulnerability can be exploited by inserting malicious payloads into any textarea field settings of the plugin, such as the 'Google Analytics' field. The exploit is specifically triggered when users access the Theme Customizer page (WPScan).

The vulnerability has been patched in version 1.7 of the Simple Theme Options plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).