CVE-2022-23980: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in the Yasr – Yet Another Stars Rating WordPress plugin versions 2.9.9 and earlier. The vulnerability was identified in the 'source' parameter and was disclosed on February 3, 2022 (Patchstack Advisory).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 6.1 (Medium) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned a CVSS score of 4.7 (Medium) (NVD Database).

The vulnerability could allow malicious actors to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site, potentially compromising user data and website integrity (Patchstack Advisory).

The vulnerability is exploitable by unauthenticated users, requiring no special privileges to execute. The attack vector is network-accessible and requires user interaction for successful exploitation (NVD Database).

The vulnerability was patched in version 3.0.0 of the YASR plugin. Website administrators are advised to update to version 3.0.0 or later to resolve the security issue (Patchstack Advisory).