CVE-2022-4459: 
WordPress vulnerability analysis and mitigation

The WP Show Posts WordPress plugin before version 1.1.4 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-4459. The vulnerability was discovered and publicly disclosed on January 11, 2023. The issue affects the plugin's shortcode functionality, specifically impacting WordPress installations running versions prior to 1.1.4 (WPScan Advisory).

The vulnerability stems from improper validation and escaping of shortcode attributes before they are output back in the page. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Cross-Site Scripting (NVD).

This vulnerability allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. These attacks could be leveraged against high-privilege users such as administrators, potentially leading to unauthorized actions being performed in their context (WPScan Advisory).

The recommended mitigation is to update the WP Show Posts plugin to version 1.1.4 or later, which contains the security fix for this vulnerability (WPScan Advisory).