CVE-2022-2538: 
WordPress vulnerability analysis and mitigation

The WP Hide & Security Enhancer WordPress plugin before version 1.8 contains a Reflected Cross-Site Scripting vulnerability (CVE-2022-2538). The vulnerability was discovered and publicly published on August 8, 2022. The issue affects the WordPress plugin wp-hide-security-enhancer and was fixed in version 1.8 (WPScan).

The vulnerability occurs because the plugin does not properly escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting vulnerability. The CVSS v3.1 base score is 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD, WPScan).

If exploited, this vulnerability could allow an attacker to execute malicious JavaScript code in a victim's browser session when they visit the affected admin page. This could potentially lead to unauthorized access to sensitive information or manipulation of the user's browser session (WPScan).

The vulnerability can be exploited by sending a specially crafted URL to an authenticated user. A proof of concept exists demonstrating the exploitation via the URL: http://example.com/wp-admin/admin.php?page=wp-hide-cdn&component=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28/XSS/%29+x (WPScan).

The vulnerability has been fixed in version 1.8 of the WP Hide & Security Enhancer plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).