CVE-2022-4650: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2022-4650) affects the HashBar WordPress Notification Bar plugin versions prior to 1.3.6. It was discovered and publicly disclosed on December 27, 2022. The vulnerability is a Stored Cross-Site Scripting (XSS) issue that affects users with contributor-level permissions or higher (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes in the HashBar WordPress plugin. It is classified as CWE-79 (Cross-Site Scripting) with a CVSS score of 6.8 (medium severity). The vulnerability can be exploited through a malicious shortcode using the following format: [hashbar_btn btn_target='" onmouseover="alert(1)"'] (WPScan).

The vulnerability allows attackers with contributor-level access or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to the execution of malicious JavaScript code in users' browsers who view the affected content (WPScan).

The vulnerability has been fixed in version 1.3.6 of the HashBar WordPress Notification Bar plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).