CVE-2022-3690: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2022-3690) affects the Popup Maker WordPress plugin versions before 1.16.11. The vulnerability was discovered and reported by security researcher c3p0d4y, with the initial disclosure occurring on October 26, 2022. This security flaw exists in the plugin's popup options handling functionality (CVE Mitre, WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 6.8 (medium severity). The technical root cause stems from the plugin's failure to properly sanitize and escape certain Popup options. This vulnerability is categorized as CWE-79 and falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows users with roles as low as Contributor to perform Stored Cross-Site Scripting attacks that could potentially target administrative users. This creates a significant security risk as it enables lower-privileged users to inject malicious scripts that could be executed in the context of administrative sessions (WPScan).

The vulnerability has been patched in version 1.16.11 of the Popup Maker plugin. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).