CVE-2022-4672: 
WordPress vulnerability analysis and mitigation

The WordPress Simple Shopping Cart plugin (versions before 4.6.2) contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-4672. The vulnerability was publicly disclosed on December 27, 2022, and affects users with contributor-level privileges or higher. The issue stems from improper validation and escaping of shortcode attributes before they are output back to the page (WPScan Advisory).

The vulnerability exists due to insufficient input validation and escaping of shortcode attributes in the WordPress Simple Shopping Cart plugin. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Cross-Site Scripting (NVD Database).

When exploited, this vulnerability allows attackers with contributor-level access to perform Stored Cross-Site Scripting attacks that can target high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed with administrator privileges (WPScan Advisory).

A proof of concept exploit has been published that demonstrates the vulnerability using a malicious shortcode: [wp_cart_button name='xss' price='1' button_text='" onmouseover="alert(1)" style="background:red;"']. The exploit can be triggered when an administrator views the affected page (WPScan Advisory).

The vulnerability has been patched in version 4.6.2 of the WordPress Simple Shopping Cart plugin. Site administrators are advised to update to this version or later to mitigate the security risk (WPScan Advisory).