CVE-2022-1644: 
WordPress vulnerability analysis and mitigation

CVE-2022-1644 affects the Call&Book Mobile Bar WordPress plugin through version 1.2.2. The vulnerability was discovered and disclosed in May 2022, specifically impacting the plugin's settings functionality. The issue exists because the plugin does not properly sanitize and escape some of its settings (NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that affects high-privilege users such as administrators, even when unfiltered_html is disallowed. The vulnerability has a CVSS score of 3.4 (low severity) and is categorized under CWE-79 (Cross-Site Scripting) (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Cross-Site Scripting attacks by inserting malicious scripts into the plugin's settings. This could potentially lead to the execution of unauthorized JavaScript code in other users' browsers when they access the affected pages (WPScan).

The vulnerability can be exploited by inserting malicious scripts into any of the plugin's settings fields. A proof of concept exists demonstrating that an attacker can inject arbitrary JavaScript code through the plugin's configuration options (WPScan).