CVE-2022-2173: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Advanced Database Cleaner WordPress plugin versions below 3.1.1. The vulnerability was publicly disclosed on June 27, 2022, and was assigned CVE-2022-2173. The issue was discovered by ZhongFu Su(JrXnm) of WuHan University (WPScan).

The vulnerability stems from the plugin's failure to properly escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages. This security flaw has been assigned a CVSS score of 6.1 (medium severity) and is classified under CWE-79. A proof of concept exploit involves accessing a specifically crafted URL in the admin dashboard: https://example.com/wp-admin/admin.php?page=advanced_db_cleaner&aDBc_tab=cron&aDBc_cat=all&">alert(/XSS/) (WPScan).

The vulnerability allows attackers to execute cross-site scripting attacks through the admin dashboard pages, potentially compromising the security of the WordPress installation and its users (WPScan).

The vulnerability has been fixed in version 3.1.1 of the Advanced Database Cleaner plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).