CVE-2022-3985: 
WordPress vulnerability analysis and mitigation

The Videojs HTML5 Player WordPress plugin before version 1.1.9 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-3985. The vulnerability was discovered and publicly disclosed on November 22, 2022, by security researcher Lana Codes (WPScan).

The vulnerability stems from the plugin's failure to properly validate and escape certain shortcode attributes before outputting them back in the page. This security flaw has been assigned a CVSS score of 6.8 (medium severity) and is classified under CWE-79. The vulnerability falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows users with privileges as low as contributor level to perform Stored Cross-Site Scripting attacks. When exploited, malicious scripts can be injected into the website's pages, which will then be executed when other users view the affected pages (WPScan).

A proof of concept exists demonstrating that the vulnerability can be exploited by inserting a malicious shortcode in a page or post using the format: [videojs_video url='" onerror=alert(/XSS/) "']. The XSS payload is triggered when viewing or previewing the affected page or post (WPScan).

The vulnerability has been fixed in version 1.1.9 of the Videojs HTML5 Player plugin. Website administrators are advised to update to this version or later to protect against this security issue (WPScan).