CVE-2022-2941

CVE-2022-2941 describes multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the WP-UserOnline plugin for WordPress, affecting versions up to and including 2.88.0. This flaw stems from insufficient sanitization and escaping of user input in the "Naming Conventions" section, specifically impacting multi-site installations or those with unfiltered_html disabled. Rated as MEDIUM severity (CVSS 4.8), the vulnerability requires an authenticated attacker with administrative privileges to inject malicious JavaScript code. The attack vector is network-based with low complexity, but requires user interaction (UI:R) for the script to execute when a user accesses the compromised page, leading to potential low impact on confidentiality and integrity. While there is no evidence of active exploitation (KEV: No) and minimal community discussion or media coverage, a public exploit (EDB-51020) is available on ExploitDB. No Metasploit or Nuclei modules are currently identified for this vulnerability.