CVE-2022-1266: 
WordPress vulnerability analysis and mitigation

The Post Grid, Slider & Carousel Ultimate WordPress plugin before version 1.5.0 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-1266. The vulnerability was discovered in April 2022 and publicly disclosed on May 26, 2022. The issue affects the plugin's Header Title functionality, which fails to properly sanitize and escape input (WPScan).

The vulnerability stems from improper input sanitization in the Header Title field of the plugin. The CVSS v3.1 base score is 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows high-privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The impact is considered low to medium as it requires high privileges to exploit (WPScan).

The vulnerability can be exploited by creating a new Grid/Carousel, enabling 'Display Header Title' in the General Settings, and inserting malicious payload in the 'Header Title' field. The XSS payload is triggered when viewing the Post Grid/Carousel in the post (WPScan).

The vulnerability has been fixed in version 1.5.0 of the Post Grid, Slider & Carousel Ultimate plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).