CVE-2022-23987: vulnerability in WS Form LITE – Drag & Drop Contact Form…
WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting
Published · Updated
Follow this CVE+ Monitor WS Form Pro+ Monitor WS Form LITE – Drag & Drop Contact Form Builder for WordPress
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.6%
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected products
WS Form · WS Form LITE – Drag & Drop Contact Form Builder for WordPressWS Form · WS Form ProRelated CVEs — WS Form LITE – Drag & Drop Contact Form…
In the same product, most dangerous first.
CVE-2022-23988—WS Form < 1.8.176 - Unauthenticated Stored Cross-Site ScriptingEPSS 2.2%CVE-2023-5424MEDIUMWS Form LITE <= 1.9.217 - Unauthenticated CSV InjectionEPSS 0.5%CVE-2023-52135HIGHWordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-13509HIGHWS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%