CVE-2023-4022: 
WordPress vulnerability analysis and mitigation

CVE-2023-4022 affects the Herd Effects WordPress plugin versions before 5.2.3. The vulnerability was discovered and publicly published on August 21, 2023. This security issue impacts WordPress installations using the affected plugin versions, particularly in multisite setups (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 4.8 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The core issue stems from the plugin's failure to properly sanitize and escape certain settings, allowing for potential XSS attacks even when the unfiltered_html capability is disabled (NVD, WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite setups where even administrators are typically restricted from using unfiltered HTML (WPScan).

The vulnerability has been fixed in version 5.2.3 of the Herd Effects plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).