CVE-2022-2473: 
WordPress vulnerability analysis and mitigation

The WP-UserOnline plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2022-2473) in versions up to and including 2.87.6. The vulnerability exists in the 'templates[browsingpage][text]' parameter due to insufficient input sanitization and output escaping. This vulnerability was discovered and disclosed in July 2022 (NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 4.8 (Medium) according to NVD, and 5.5 (Medium) according to Wordfence. The vulnerability specifically affects the plugin's settings in the User(s) Browsing Site template section, where malicious scripts can be injected and stored. The vulnerability only affects multi-site installations and installations where unfiltered_html is disabled (WPScan).

When exploited, this vulnerability allows authenticated attackers with administrative capabilities to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page, potentially leading to unauthorized actions or data theft (NVD).

The vulnerability has been patched in version 2.88.0 of the WP-UserOnline plugin. Site administrators are advised to update to this version or later to mitigate the risk (WPScan).