CVE-2022-1090: 
WordPress vulnerability analysis and mitigation

The Good & Bad Comments WordPress plugin through version 1.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on March 25, 2022, and was assigned CVE-2022-1090. The issue affects all versions of the plugin up to and including version 1.0.0 (WPScan).

The vulnerability exists because the plugin fails to properly sanitize and escape its settings. This security flaw received a CVSS v3.1 Base Score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in scenarios where the unfiltered_html capability is disallowed, such as in multisite setups. This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan).

There is no known fix available for this vulnerability as reported in the sources. Users of the Good & Bad Comments WordPress plugin should consider either removing the plugin or implementing additional security controls to restrict access to the plugin's settings (WPScan).