CVE-2022-23987

State: PUBLISHED · Published: 2022-02-28 · Updated: 2024-08-03 · Assigner: WPScan

Description

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CWE

CWE-79 — CWE-79 Cross-site Scripting (XSS)

Affected

WS Form / WS Form LITE – Drag & Drop Contact Form Builder for WordPress — v=1.8.176 <1.8.176 [affected]
WS Form / WS Form Pro — v=1.8.176 <1.8.176 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/1697351b-c201-4e85-891e-94fdccbdfb55 x_refsource_MISC

Source

cvelistV5-main/cves/2022/23xxx/CVE-2022-23987.json