CVE-2022-4710: 
WordPress vulnerability analysis and mitigation

The Royal Elementor Addons plugin for WordPress (CVE-2022-4710) is a Reflected Cross-Site Scripting vulnerability affecting versions up to and including 1.3.59. The vulnerability was disclosed on January 10, 2023, and impacts the plugin's datafetch function specifically through the 'wprajaxsearchlink_target' parameter (NVD).

The vulnerability stems from insufficient input sanitization and output escaping of the 'wprajaxsearchlinktarget' parameter in the 'datafetch' function. The use of 'sanitizetext_field' was found to be inadequate for preventing attribute-based Cross-Site Scripting. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (Wordfence).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when users perform specific actions, such as clicking on a malicious link. This can lead to potential compromise of user data and session information (NVD).

Users are advised to update their Royal Elementor Addons plugin to a version newer than 1.3.59, which contains the security patch for this vulnerability (Wordfence).