CVE-2022-2540: 
WordPress vulnerability analysis and mitigation

The Link Optimizer Lite plugin for WordPress (versions up to 1.4.5) was identified with CVE-2022-2540, a vulnerability combining Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS). The vulnerability was discovered and reported by researcher Hayato Takizawa (Wordfence Advisory).

The vulnerability stems from missing nonce validation in the admin_page function located in the ~/admin.php file. This security flaw received a CVSS v3.1 score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high-severity issue requiring user interaction but no privileges for exploitation (NVD).

When successfully exploited, this vulnerability allows unauthenticated attackers to modify the plugin's settings and inject malicious web scripts through forged requests. The attack requires tricking a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

The vulnerability requires no authentication and can be exploited remotely, though it does require user interaction from a site administrator. The attack complexity is considered low, making it relatively straightforward to exploit once the social engineering component is successful (Wordfence Advisory).

Website administrators running the affected versions of Link Optimizer Lite should upgrade to a patched version of the plugin. The vulnerability was present in versions up to and including 1.4.5 (NVD).