CVE-2022-2167: 
WordPress vulnerability analysis and mitigation

CVE-2022-2167 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Newspaper WordPress theme versions below 12. The vulnerability was discovered by Truoc Phan from Techlab Corporation and was publicly disclosed on October 10, 2022. The issue has been assigned a CVSS score of 6.1 (medium severity) (WPScan).

The vulnerability exists because the theme does not properly sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. Specifically, the affected parameter is 'acts.td_atts.image_size'. This lack of sanitization leads to a Reflected Cross-Site Scripting vulnerability. The issue is tracked as CWE-79 and falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows attackers to execute malicious scripts in the context of the affected website, potentially leading to theft of sensitive information, session hijacking, or other malicious actions that can be performed through cross-site scripting attacks (WPScan).

The vulnerability has been fixed in version 12 of the Newspaper theme. Users are advised to upgrade to this version or later to mitigate the risk (WPScan).