CVE-2022-25609: 
WordPress vulnerability analysis and mitigation

Stored Cross-Site Scripting (XSS) vulnerability (CVE-2022-25609) was discovered in Yoo Slider – Image Slider & Video Slider WordPress plugin versions up to and including 2.0.0. The vulnerability was reported on March 21, 2022, and affects users with contributor or higher user role privileges (Patchstack Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 Base Score of 5.4 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), needs low privileges (PR:L), and requires user interaction (UI:R) with changed scope (S:C). The impact includes low confidentiality (C:L) and integrity (I:L) with no availability impact (A:N) (NVD).

The vulnerability allows malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts are executed when guests visit the affected site (Patchstack Advisory).

The vulnerability was patched in version 2.1.0 of the Yoo Slider plugin. Users are advised to update to version 2.1.0 or later to remove the vulnerability (Patchstack Advisory).