CVE-2022-1170: 
WordPress vulnerability analysis and mitigation

CVE-2022-1170 affects the JobMonster WordPress theme versions before 4.5.2.9. The vulnerability is an unauthenticated reflected Cross-Site Scripting (XSS) issue that exists because the input for the search form is provided through unsanitized GET requests (WPScan).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS score of 6.1 (medium severity). The vulnerability can be exploited through unsanitized GET requests in the theme's search form functionality. A proof of concept demonstrates that an attacker can inject malicious scripts through the search parameter: https://example.com/resumes/?s="><img+src=x+onerror=alert(1)> (WPScan).

This vulnerability allows attackers to execute arbitrary JavaScript code in users' browsers when they visit a specially crafted URL. As an unauthenticated reflected XSS vulnerability, it could be used to steal session cookies, perform actions on behalf of users, or manipulate the website's content as displayed to users (WPScan).

The vulnerability is easily exploitable as it requires no authentication and can be triggered through a simple GET request to the affected search functionality. A proof of concept exploit has been publicly documented (WPScan).

The vulnerability has been fixed in JobMonster version 4.5.2.9. Users should upgrade to this version or later to protect against this security issue. The fix involves proper sanitization of GET request parameters in the search form functionality (WPScan, ThemeForest).