CVE-2022-4788: 
WordPress vulnerability analysis and mitigation

The CVE-2022-4788 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Embed PDF versions 1.0.6 and below. The vulnerability was publicly disclosed on February 2, 2023. The issue exists because the plugin does not properly validate and escape some of its shortcode attributes before outputting them back in a page or post where the shortcode is embedded (WPScan).

The vulnerability has been assigned a CVSS score of 6.8 (Medium) and is classified under CWE-79 (Cross-Site Scripting). The vulnerability can be exploited by users with contributor-level access or higher. A proof of concept exploit involves using malicious JavaScript code within the shortcode attributes: [gdoc class='" onmouseover="alert(1)"']http://localhost/xss.pdf[/gdoc] (WPScan).

When successfully exploited, this vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. This could potentially lead to client-side code execution in the context of other users' browsers who view the affected pages (WPScan).

As of the vulnerability disclosure, there is no known fix available for this issue in the dirtysuds-embed-pdf plugin (WPScan).