CVE-2022-4267: 
WordPress vulnerability analysis and mitigation

CVE-2022-4267 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin 'Bulk Delete Users by Email' versions 1.2 and below. The vulnerability was discovered and publicly disclosed on December 2, 2022, by WPScan (WPScan Report).

The vulnerability stems from improper input validation where the plugin fails to sanitize and escape a parameter before outputting it back in the page. This security flaw has been assigned a CVSS score of 6.1 (medium severity) and is classified under CWE-79. The vulnerability falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan Report).

When exploited, this vulnerability could allow attackers to execute malicious scripts in the context of the victim's browser session, potentially leading to theft of sensitive information, session hijacking, or other malicious actions typically associated with XSS attacks (WPScan Report).

As of the vulnerability disclosure, there is no known fix available for this security issue. Website administrators using the affected plugin should consider either removing the plugin or implementing additional security controls to restrict access to the affected functionality (WPScan Report).