CVE-2022-4765: 
WordPress vulnerability analysis and mitigation

CVE-2022-4765 affects the Portfolio for Elementor WordPress plugin versions before 2.3.1. The vulnerability was discovered and disclosed on January 3, 2023. This security issue affects WordPress installations running the vulnerable versions of the Portfolio for Elementor plugin (WPScan).

The vulnerability is a Stored Cross-Site Scripting (XSS) issue that exists due to improper validation and escaping of shortcode attributes before they are output back in the page. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows users with privileges as low as contributor to perform Stored Cross-Site Scripting attacks that could be used against high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed in the context of the administrator's session (WPScan).

The vulnerability can be exploited using specially crafted shortcode attributes. A proof of concept exploit has been published that involves using the powerfolio shortcode with malicious attributes: [powerfolio zoom_effect='" onmouseover="alert(1)" style="background:red;width:100px;height:100px;"'] (WPScan).

The vulnerability has been fixed in version 2.3.1 of the Portfolio for Elementor plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).