CVE-2022-23988: fallo en WS Form LITE – Drag & Drop Contact Form…
WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear WS Form Pro+ Monitorear WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.2%
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Productos afectados
WS Form · WS Form LITE – Drag & Drop Contact Form Builder for WordPressWS Form · WS Form ProCVEs relacionadas — WS Form LITE – Drag & Drop Contact Form…
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23987—WS Form < 1.8.176 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5424MEDIUMWS Form LITE <= 1.9.217 - Unauthenticated CSV InjectionEPSS 0.5%CVE-2023-52135HIGHWordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-13509HIGHWS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%