CVE-2022-0876: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-0876 affects the WordPress plugin 'Social comments by WpDevArt' versions below 2.5.0. This is a Stored Cross-Site Scripting (XSS) vulnerability that affects users with administrative privileges (WPScan).

The vulnerability exists because the plugin fails to properly sanitize and escape its settings, which allows high-privilege users such as administrators to perform cross-site scripting attacks even when the unfiltered_html capability is disabled. The vulnerability can be exploited through the plugin's text field settings, including fields such as Title and Title font-size (WPScan).

When exploited, this vulnerability allows administrative users to store and execute malicious JavaScript code in the plugin's settings, which could potentially affect other users who access the affected pages (WPScan).

The vulnerability requires an attacker to have administrative access to the WordPress installation. The exploit can be triggered by inserting malicious scripts into any of the plugin's text field settings (WPScan).

Users should upgrade to version 2.5.0 or later of the Social comments by WpDevArt plugin to address this vulnerability (WPScan).