CVE-2022-1027: 
WordPress vulnerability analysis and mitigation

The Page Restriction WordPress plugin before version 1.2.7 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-1027. The vulnerability was discovered by Niraj Mahajan and publicly disclosed on April 1, 2022. This security issue affects the plugin's settings page and is specifically related to administrator-level access (WPScan).

The vulnerability allows attackers with administrator privileges to inject malicious JavaScript code into the plugin's settings page. The injection point is specifically located in the Page/Post Access tab, where XSS payloads can be inserted into any of the available pages. The vulnerability has been assigned a CVSS score of 3.5 (low severity) and is classified under CWE-79 (Cross-Site Scripting) (WPScan).

The exploitation of this vulnerability results in stored Cross-Site Scripting that exclusively affects administrator users accessing the plugin's admin panel. The scope of the impact is limited to users with administrative privileges (CVE Mitre, WPScan).

The vulnerability has been fixed in version 1.2.7 of the Page Restriction WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).