CVE-2022-47608

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
FullworksQuick Contact Form<= 8.0.3.1

References

Timeline

Published
Apr 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-476098.8Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <= 2.8.1 versions.CVE-2022-47615.4The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them bacCVE-2022-476104.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.CVE-2022-476118.8Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m Hover Image plugin <= 1.4.1 versions.CVE-2022-476124.3Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column CVE-2022-476134.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions.CVE-2022-476147.5Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.CVE-2022-476159.8Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.CVE-2022-476167.2Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an aCVE-2022-476177.2Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrCVE-2022-476189.8Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentialCVE-2022-47625.4The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them
CVE-2022-47608: Medium severity, CVSS 4.8 | Vulnix