CVE-2022-1995

CVE-2022-1995 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Malware Scanner WordPress plugin prior to version 4.5.2. It allows malicious administrators to inject JavaScript into plugin settings due to insufficient input sanitization, which can then execute in a user's browser, particularly in environments where unfiltered_html is restricted. This vulnerability has a CVSS score of 4.8 (Medium), indicating a low attack complexity and requiring high privileges for exploitation, with potential for limited impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.