CVE-2022-2374

CVE-2022-2374 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Simply Schedule Appointments WordPress plugin versions prior to 1.5.7.7. This flaw allows high-privilege users, such as administrators, to inject malicious scripts due to insufficient sanitization and escaping of certain settings, even when the unfiltered_html capability is restricted. The vulnerability carries a CVSS score of 4.8 (Medium severity), indicating that an attacker could exploit it over a network with low attack complexity, requiring user interaction, and potentially leading to low impact on confidentiality and integrity. The EPSS score is very low, suggesting a minimal probability of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are also minimal, indicating low public awareness and attention.