CVE-2022-46819: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Gopi Ramasamy Continuous announcement scroller WordPress plugin versions 13.0 and below. The vulnerability was reported on December 7, 2022, and was publicly disclosed on April 19, 2023. This security issue requires administrator-level authentication to exploit (Patchstack).

The vulnerability has been assigned CVE-2022-46819 and is classified as a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79). It received a CVSS v3.1 base score of 4.8 (MEDIUM) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher score of 5.9 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow a malicious actor with administrator privileges to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would then be executed when guests visit the affected site (Patchstack).

As of the latest reports, no official fix has been made available for this vulnerability. Given the low severity impact and the requirement for administrator-level access, the risk is considered minimal (Patchstack).