CVE-2022-1474: 
WordPress vulnerability analysis and mitigation

The WP Event Manager WordPress plugin before version 3.1.28 contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-1474. The vulnerability was discovered on April 26, 2022, and publicly disclosed on June 20, 2022. This security issue affects the event dashboard functionality of the WordPress plugin (WPScan).

The vulnerability stems from improper input sanitization and escaping of search parameters in the event dashboard. The CVSS v3.1 base score is 6.1 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows attackers to execute cross-site scripting attacks against authenticated users of the WordPress site. The attack can lead to the compromise of user sessions, theft of sensitive information, and potential manipulation of the website content (WPScan).

The vulnerability has been patched in WP Event Manager version 3.1.28. Site administrators are strongly advised to update to this version or later to mitigate the security risk (WPScan).