CVE-2022-23987: falha em WS Form LITE – Drag & Drop Contact Form…
WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar WS Form Pro+ Monitorar WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.6%
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Produtos afetados
WS Form · WS Form LITE – Drag & Drop Contact Form Builder for WordPressWS Form · WS Form ProCVEs relacionadas — WS Form LITE – Drag & Drop Contact Form…
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23988—WS Form < 1.8.176 - Unauthenticated Stored Cross-Site ScriptingEPSS 2.2%CVE-2023-5424MEDIUMWS Form LITE <= 1.9.217 - Unauthenticated CSV InjectionEPSS 0.5%CVE-2023-52135HIGHWordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-13509HIGHWS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%