CVE-2022-4243: 
WordPress vulnerability analysis and mitigation

CVE-2022-4243 affects the WordPress plugin ImageInject (wp-inject) versions 1.17 and below. The vulnerability was discovered and publicly disclosed on December 2, 2022. This security issue is identified as a Stored Cross-Site Scripting (XSS) vulnerability that affects administrative users (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 3.4 (low severity) and is mapped to CWE-79. The security flaw exists because the plugin fails to properly sanitize and escape certain settings, which could enable high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite setups (WPScan).

The vulnerability allows high-privilege users, specifically administrators, to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite WordPress installations where the unfiltered_html capability is typically disabled as a security measure (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue (WPScan).