CVE-2022-3822: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-3822 affects the Donations via PayPal WordPress plugin versions before 1.9.9. The vulnerability was discovered and publicly disclosed on November 4, 2022. It involves improper sanitization and escaping of plugin settings, potentially allowing stored Cross-Site Scripting (XSS) attacks (WPScan Details, CVE Mitre).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79. It has been assigned a CVSS score of 3.4 (low severity). The technical issue stems from the plugin's failure to properly sanitize and escape certain settings, which becomes exploitable even when the unfiltered_html capability is disabled, such as in multisite setups (WPScan Details).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite setups where even with unfiltered_html capability restrictions, the vulnerability can still be exploited (WPScan Details).

The vulnerability has been fixed in version 1.9.9 of the Donations via PayPal WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan Details).