CVE-2022-2410: 
WordPress vulnerability analysis and mitigation

The mTouch Quiz WordPress plugin through version 3.1.3 contains a stored Cross-Site Scripting (XSS) vulnerability that was discovered in July 2022. The vulnerability affects the plugin's settings functionality and impacts WordPress installations where the plugin is active (WPScan).

The vulnerability stems from improper sanitization and escaping of plugin settings, particularly in the delimiter settings. This security flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, which is common in multisite setups. This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan).

As of the latest reports, there is no known fix available for this vulnerability. Users running mTouch Quiz version 3.1.3 or earlier should consider implementing additional security controls or limiting access to administrative functions (WPScan).