CVE-2022-1009: 
WordPress vulnerability analysis and mitigation

The Smush WordPress plugin before version 3.9.9 contains a Reflected Cross-Site Scripting vulnerability (CVE-2022-1009) discovered in March 2022. The vulnerability exists due to improper sanitization and escaping of configuration parameters in the admin page when handling preset configurations (WPScan, MITRE).

The vulnerability stems from the plugin's failure to properly sanitize and escape configuration parameters before outputting them back in an admin page. This occurs specifically when uploading preset configurations through the Smush Settings page at /wp-admin/admin.php?page=smush-settings&view=configs. An attacker can exploit this by crafting a malicious configuration file containing JavaScript code (WPScan).

If successfully exploited, this vulnerability allows for Reflected Cross-Site Scripting attacks against WordPress administrators. The impact is limited to admin users as the attack requires the ability to upload configuration files through the admin interface (WPScan).

The vulnerability has been patched in Smush version 3.9.9. Users are advised to update to this version or later to mitigate the risk. No alternative workarounds have been published (MITRE).