CVE-2022-3892

CVE-2022-3892 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP OAuth Server WordPress plugin prior to version 4.2.2. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into Client IDs due to insufficient input sanitization, even in environments where unfiltered_html is typically restricted. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with low complexity, requiring high privileges and user interaction, potentially leading to limited confidentiality and integrity impacts. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, indicating a low level of attention and perceived threat.