CVE-2022-21662: 
NixOS vulnerability analysis and mitigation

CVE-2022-21662 is a Stored Cross-Site Scripting (XSS) vulnerability affecting WordPress versions up to and including 5.8.2. The vulnerability was discovered by Karim El Ouerghemmi and Simon Scannell of SonarSource and was disclosed in January 2022. The issue allows low-privileged authenticated users (like authors) to execute JavaScript through stored XSS attacks via post slugs, which can affect high-privileged users including administrators (SonarSource Blog, WordPress Advisory).

The vulnerability exists in the WordPress core's handling of post slugs. The issue occurs in the _truncate_post_slug() function when processing slugs longer than 200 characters containing URL-encoded characters. The function uses urldecode() to process the slug but then uses utf8_uri_encode() for re-encoding, which only encodes Unicode characters, leaving potential XSS payloads unencoded. This discrepancy between decoding and encoding functions creates the vulnerability. The CVSS score varies between sources, with NVD rating it at 5.4 (Medium) and GitHub rating it at 8.0 (High) (NVD, SonarSource Blog).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to privilege escalation, account hijacking, and potential server compromise through administrative actions. When combined with certain plugins like bbPress (versions < 2.6.0), the vulnerability could be exploited without any privileged account, making it particularly dangerous for public-facing WordPress installations (SonarSource Blog).

The vulnerability requires an authenticated user with author-level privileges to create posts. Exploitation involves creating two posts with specially crafted slugs containing URL-encoded JavaScript payloads exceeding 200 characters. The attack becomes more severe when combined with bbPress plugin versions below 2.6.0, as it allows exploitation without any privileged account (Trustwave Blog).

The vulnerability was patched in WordPress version 5.8.3, with security backports provided for all versions since 3.7.37. The fix modifies the utf8_uri_encode() function by adding an optional parameter $encode_ascii_characters which, when set to true, ensures proper encoding of non-alphanumeric characters using rawurlencode(). Users are strongly recommended to keep auto-updates enabled and upgrade to the patched versions (WordPress Release, GitHub Advisory).