CVE-2022-2187

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-218707.8Tablet Windows User Interface Application Core Elevation of Privilege VulnerabilityCVE-2022-218717.8Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege VulnerabilityCVE-2022-218727.8Windows Event Tracing Elevation of Privilege VulnerabilityCVE-2022-218737.8Tile Data Repository Elevation of Privilege VulnerabilityCVE-2022-218749.8Windows Security Center API Remote Code Execution VulnerabilityCVE-2022-218757.8Windows Storage Elevation of Privilege VulnerabilityCVE-2022-218765.5Win32k Information Disclosure VulnerabilityCVE-2022-218775.5Storage Spaces Controller Information Disclosure VulnerabilityCVE-2022-218787.8Windows Geolocation Service Remote Code Execution VulnerabilityCVE-2022-218797.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-21885.5Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploitingCVE-2022-218807.5Windows GDI+ Information Disclosure Vulnerability