CVE-2022-4110: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-4110 affects the Eventify™ WordPress plugin through version 2.1. The vulnerability was discovered and publicly disclosed on November 30, 2022. It specifically impacts the plugin's settings functionality, where certain configuration options are not properly sanitized and escaped (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 4.8 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is categorized under CWE-79 and has been assigned a CVSS score of 3.4 (low) by the security community (NVD, WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in scenarios where the unfiltered_html capability is explicitly disallowed, such as in multisite setups. This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan).

The vulnerability can be exploited by accessing the Eventify settings page and injecting malicious payload into the 'Category Slug For Events Saved As Blog Posts' field. A proof of concept demonstrates that an attacker can trigger the XSS by inserting the payload '"><alert(/XSS/)<"' and updating the Category Slug (WPScan).

As of the latest reports, there is no known fix available for this vulnerability in the Eventify WordPress plugin (WPScan).