CVE-2022-4747: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-4747 affects the WordPress plugin 'Post Category Image With Grid and Slider' versions up to 1.4.7. This security issue was discovered by István Márton and was publicly disclosed on January 4, 2023. The vulnerability is related to improper validation and escaping of shortcode attributes in the plugin (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 6.4 (Medium). The technical root cause involves the plugin's failure to properly validate and escape certain shortcode attributes before outputting them back in the page. This vulnerability is categorized as CWE-79: Cross-Site Scripting (WPScan, Wordfence).

The vulnerability allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks that could be used against high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed in the context of the administrator's session (WPScan).

The vulnerability has been fixed in version 1.4.8 of the Post Category Image With Grid and Slider plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).