CVE-2022-45365: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in Aleksandar Urošević's Stock Ticker WordPress plugin, affecting versions up to 3.23.2. The vulnerability was identified on November 19, 2022, and was assigned CVE-2022-45365. This security issue allows for improper neutralization of input during web page generation (Patchstack).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, falling under the OWASP Top 10 category A7. It received a CVSS v3.1 base score of 6.1 (Medium) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a slightly higher CVSS score of 7.1 (High) (NVD, Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability has been fixed in version 3.23.3 of the Stock Ticker plugin. Users are advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).