CVE-2022-0402

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04038.1The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by CVE-2022-04046.5The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notic CVE-2022-04054.3Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04064.3Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04077.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04087.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04097.8Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.CVE-2022-04108.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a CVE-2022-04118.8The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a CVE-2022-04129.8The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and e CVE-2022-04137.8Use After Free in GitHub repository vim/vim prior to 8.2.CVE-2022-04144.3Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.