CVE-2022-36791: 
WordPress vulnerability analysis and mitigation

The vulnerability identified as CVE-2022-36791 is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability affecting the Torro Forms WordPress plugin versions 1.0.16 and below. The vulnerability was discovered and publicly disclosed on September 2, 2022, and was assigned by Patchstack OÜ (MITRE).

The vulnerability exists due to insufficient sanitization and escaping of certain parameters in the Torro Forms plugin. The vulnerability has been assigned a CVSS score of 6.8 (medium severity) and is classified under CWE-79. The security issue allows users with contributor-level permissions or higher to perform Cross-Site Scripting attacks (WPScan).

When exploited, this vulnerability could allow authenticated users with contributor-level access or higher to inject malicious scripts into the website. These scripts could then be executed in other users' browsers, potentially leading to unauthorized actions, data theft, or session hijacking (WPScan).

As of December 9, 2022, the Torro Forms plugin has been closed and is no longer available for download from the WordPress plugin repository due to guideline violations. Users are advised to remove the plugin and find alternative form solutions for their WordPress websites (WordPress Plugin).