CVE-2022-23987

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WS Form	WS Form LITE – Drag & Drop Contact Form Builder for WordPress	>= 1.8.176, < 1.8.176
WS Form	WS Form Pro	>= 1.8.176, < 1.8.176

References

https://wpscan.com/vulnerability/1697351b-c201-4e85-891e-94fdccbdfb55Exploit, Third Party Advisory
https://wpscan.com/vulnerability/1697351b-c201-4e85-891e-94fdccbdfb55Exploit, Third Party Advisory

Timeline

Published: Feb 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239886.1The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker CVE-2022-239897.5In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood CVE-2022-23998.8Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2022-239907.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.CVE-2022-239929.8XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could poten CVE-2022-239936.1/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS CVE-2022-239943.3An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted CVE-2022-239953.3Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted CVE-2022-239963.3Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted appli CVE-2022-239973.3Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows un CVE-2022-239985.5Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in A CVE-2022-239993.3PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without pe