CVE-2022-4299: 
WordPress vulnerability analysis and mitigation

CVE-2022-4299 is a security vulnerability discovered in the Metricool WordPress plugin versions before 1.18. The vulnerability was publicly disclosed on December 20, 2022, and affects the plugin's settings functionality. The issue stems from inadequate sanitization and escaping of certain plugin settings (WPScan, NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79. It received a CVSS score of 3.4 (Low severity). The technical root cause involves the plugin's failure to properly sanitize and escape certain settings, particularly in the Blog or website identifier field. This vulnerability can be exploited even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

The vulnerability allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This is particularly concerning in multisite WordPress installations where even administrators typically have restricted HTML capabilities (WPScan).

The vulnerability has been fixed in version 1.18 of the Metricool plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).