CVE-2022-4471

The YARPP plugin contains a stored cross-site scripting vulnerability in its shortcode implementation affecting versions up to 5.30.2, caused by inadequate sanitization and escaping of user-supplied shortcode attributes. Authenticated users with contributor-level access or higher can exploit this flaw to inject malicious scripts that execute when site visitors view pages containing the compromised shortcode. An additional vulnerable shortcode attribute called template was discovered in the same affected versions and remedied in version 5.30.3.

Based on public CVE data (MITRE/NVD).