CVE-2022-4472: 
WordPress vulnerability analysis and mitigation

The Simple Sitemap WordPress plugin versions before 3.5.8 contained a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-4472. The vulnerability affected users with contributor-level permissions or higher and was discovered in early 2023 (WPScan).

The vulnerability exists because the plugin does not properly validate and escape certain shortcode attributes before outputting them back in the page. This allows users with contributor-level access or higher to inject malicious JavaScript code through shortcode attributes that gets stored and executed when viewed by other users (WPScan). The vulnerability has been assigned a CVSS score of 6.8 (medium severity).

If exploited, this vulnerability could allow attackers with contributor-level access to perform stored Cross-Site Scripting attacks against higher privileged users such as administrators. This could potentially lead to account takeover or other malicious actions performed in the context of the victim's session (WPScan).

The vulnerability has been fixed in Simple Sitemap version 3.5.8. Site administrators should update to this version or later to protect against this security issue (WPScan).