CVE-2022-42460: 
WordPress vulnerability analysis and mitigation

A Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) was discovered in the WordPress Traffic Manager plugin versions 1.4.5 and below. The vulnerability was disclosed on October 24, 2022, and was assigned CVE-2022-42460. The affected plugin has been closed since September 19, 2022, due to security issues (Patchstack, WordPress Plugin).

The vulnerability has a CVSS v3 Base Score of 6.5 (High severity) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: Required, Scope: Changed, Confidentiality: Low, Integrity: Low, Availability: None. The vulnerability is classified under OWASP Top 10 category A5: Broken Access Control (Patchstack).

The vulnerability allows attackers with subscriber-level privileges to perform stored cross-site scripting attacks, potentially compromising the website's security and integrity. This type of vulnerability could lead to unauthorized access and manipulation of website content (Patchstack).

No official fix is available as the plugin has been closed. The recommended mitigation is to uninstall the Traffic Manager plugin immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).