CVE-2022-4835: 
WordPress vulnerability analysis and mitigation

CVE-2022-4835 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Social Sharing Toolkit WordPress plugin versions 2.6 and below. The vulnerability was discovered and publicly published on January 3, 2023. The issue affects users with contributor-level permissions or higher (WPScan).

The vulnerability exists because the plugin does not properly validate and escape shortcode attributes before outputting them back in the page. This vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified as CWE-79: Cross-Site Scripting. The vulnerability specifically relates to the social_share shortcode functionality within the plugin's Shortcode tab settings (WPScan).

When exploited, this vulnerability allows attackers with contributor-level access to perform Stored Cross-Site Scripting attacks that could be used against high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed with administrator privileges (WPScan).

The vulnerability can be exploited by using a malicious shortcode payload in the social_share shortcode's URL attribute. A proof of concept exploit has been published that demonstrates the vulnerability using the following shortcode: [social_share url='" onmouseover="alert(1)"']. The exploitation requires the attacker to have at least contributor-level access to the WordPress installation (WPScan).

As of the vulnerability disclosure, there is no known fix available for this issue in the Social Sharing Toolkit plugin (WPScan).