CVE-2022-23987: fallo en WS Form LITE – Drag & Drop Contact Form…
WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear WS Form Pro+ Monitorear WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.6%
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Productos afectados
WS Form · WS Form LITE – Drag & Drop Contact Form Builder for WordPressWS Form · WS Form ProCVEs relacionadas — WS Form LITE – Drag & Drop Contact Form…
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23988—WS Form < 1.8.176 - Unauthenticated Stored Cross-Site ScriptingEPSS 2.2%CVE-2023-5424MEDIUMWS Form LITE <= 1.9.217 - Unauthenticated CSV InjectionEPSS 0.5%CVE-2023-52135HIGHWordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-13509HIGHWS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%