CVE-2023-22685: 
WordPress vulnerability analysis and mitigation

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability was discovered in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription WordPress plugin versions 2.2 and below. The vulnerability was reported on January 12, 2023, and was assigned CVE-2023-22685. The issue was publicly disclosed on April 19, 2023, with a fix released in version 2.3 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.9 (Medium) according to Patchstack, and 4.8 (Medium) according to NIST. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires high privileges and user interaction to exploit (NVD).

This vulnerability could allow a malicious actor with administrative privileges to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

Users are advised to update to version 2.3 or later of the Category Specific RSS feed Subscription plugin to remediate this vulnerability. The fix was released as part of version 2.3 (Patchstack).