CVE-2022-2383

Deeper analysis

The vulnerability is a reflected cross-site scripting flaw (CWE-79) affecting the Feed Them Social WordPress plugin prior to version 3.0.1. It stems from insufficient sanitization and escaping of an unspecified parameter that is later reflected back into page output, as indicated by its CVSS 6.1 rating reflecting network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can exploit the issue by supplying a crafted URL containing malicious JavaScript; when a victim visits the link, the script executes in the context of the affected site, enabling limited impacts such as data exfiltration or unauthorized actions within the victim's browser session.

The primary public reference is the WPScan advisory that documents the reflected XSS condition in the plugin. The EPSS score has remained flat at a peak of 0.0639 with no material increase after disclosure.