CVE-2022-2278: 
WordPress vulnerability analysis and mitigation

The Featured Image from URL (FIFU) WordPress plugin before version 4.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-2278. The vulnerability was discovered by Raad Haddad of Cloudyrion GmbH and was publicly disclosed on July 11, 2022. This security issue affects WordPress installations using the FIFU plugin, particularly in multisite setups (WPScan).

The vulnerability stems from improper validation, sanitization, and escaping of certain plugin settings. This security flaw is classified as a Stored Cross-Site Scripting (XSS) vulnerability, categorized under CWE-79 and OWASP Top 10 A7. The severity of this vulnerability is rated as low with a CVSS score of 3.4 (WPScan).

The vulnerability could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, particularly in multisite setup environments (WPScan).

The vulnerability can be exploited through the plugin's settings page at '/wp-admin/admin.php?page=featured-image-from-url'. The XSS payload is triggered when accessing the settings again after the initial injection (WPScan).

The vulnerability has been fixed in version 4.0.1 of the Featured Image from URL plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).