CVE-2022-3631: 
WordPress vulnerability analysis and mitigation

The OAuth Client by DigitialPixies plugin version 1.1.0 and below contains a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-3631. The vulnerability was discovered and publicly disclosed on October 21, 2022. This security issue affects WordPress installations using the dpt-oauth-client plugin (WPScan).

The vulnerability exists because the plugin fails to properly sanitize and escape some of its settings. The issue has been assigned a CVSS score of 3.4 (low severity) and is classified under CWE-79 (Cross-Site Scripting). The vulnerability specifically affects high-privilege users such as administrators, even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

When exploited, this vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in users' browsers who access the affected areas of the WordPress admin panel (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Users of the affected plugin should consider implementing additional security controls or evaluating alternative solutions until a patch is released (WPScan).