CVE-2022-2563: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-2563 affects the Tutor LMS WordPress plugin versions before 2.0.10. The vulnerability was discovered and publicly disclosed on September 26, 2022. It involves improper escaping of course parameters in the plugin, which could potentially allow high-privilege users such as administrators to perform Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan Advisory).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability can be exploited through course parameters that are not properly escaped in the plugin's functionality (NVD Database).

When exploited, this vulnerability allows high-privilege users to inject malicious scripts that are stored on the server and executed when other users access the affected pages. This is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted for security purposes (WPScan Advisory).

The vulnerability has been fixed in Tutor LMS version 2.0.10. Users are advised to update their installations to this version or later to mitigate the risk (WPScan Advisory).