CVE-2022-1547: 
WordPress vulnerability analysis and mitigation

The Check & Log Email WordPress plugin before version 1.0.6 contains a Reflected Cross-Site Scripting vulnerability (CVE-2022-1547). The vulnerability was discovered and reported by 7coo and ZhongFu Su(JrXnm) of Wuhan University, and was publicly disclosed on May 2, 2022. The issue affects the plugin's admin page functionality (WPScan).

The vulnerability occurs because the plugin fails to properly sanitize and escape a parameter before outputting it back in an attribute in an admin page. This security flaw has been assigned a CVSS score of 6.1 (medium severity) and is classified under CWE-79, which relates to Cross-Site Scripting vulnerabilities. The vulnerability can be triggered through the admin settings page using a specially crafted URL (WPScan).

If exploited, this vulnerability could allow an attacker to execute malicious scripts in the context of the admin page, potentially leading to unauthorized access to sensitive information or manipulation of admin functionality (WPScan).

The vulnerability has been patched in version 1.0.6 of the Check & Log Email plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).