CVE-2022-1994: 
WordPress vulnerability analysis and mitigation

The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin (before version 1.0.8) contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered in June 2022 and affects the plugin's settings functionality, where high privilege users such as administrators can perform XSS attacks even when the unfiltered_html is disallowed (WPScan Advisory).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, specifically CWE-79 (Improper Neutralization of Input During Web Page Generation). It has a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability exists because the plugin does not properly escape its settings, allowing for XSS payload injection through the Account Name settings (NVD, WPScan Advisory).

The vulnerability allows high-privilege users such as administrators to perform Cross-Site Scripting attacks even when the unfiltered_html feature is disabled. This could potentially lead to client-side code execution in the context of other users' browsers who access the affected pages (WPScan Advisory).

The vulnerability has been fixed in version 1.0.8 of the Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin. Users should update to this version or later to mitigate the vulnerability (WPScan Advisory).