CVE-2022-2340

Name of the Vulnerable Software and Affected Versions W-DALIL WordPress plugin versions 2.0 and earlier

Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its fields.

Recommendations For W-DALIL WordPress plugin versions 2.0 and earlier, update to a version that addresses the sanitization and escaping of fields to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting the unfiltered html capability to minimize the risk of exploitation.