CVE-2022-4787: 
WordPress vulnerability analysis and mitigation

The Themify Shortcodes WordPress plugin versions before 2.0.8 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly validate and escape one of its shortcode attributes, which affects users with contributor-level permissions or higher (WPScan Vuln).

The vulnerability is tracked as CVE-2022-4787 with a CVSS v3.1 base score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue stems from improper neutralization of input during web page generation, classified as CWE-79. The vulnerability allows users with contributor-level access to inject malicious JavaScript code through shortcode attributes (NVD Database).

When exploited, this vulnerability allows attackers with contributor-level access to store and execute malicious JavaScript code that can affect other users, including administrators, who view the affected content. This could lead to session hijacking, defacement, or theft of sensitive browser data (WPScan Vuln).

Users are advised to update their Themify Shortcodes plugin to version 2.0.8 or later, which contains the security fix for this vulnerability (WPScan Vuln).