CVE-2022-23988: falha em WS Form LITE – Drag & Drop Contact Form…
WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar WS Form Pro+ Monitorar WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.2%
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Produtos afetados
WS Form · WS Form LITE – Drag & Drop Contact Form Builder for WordPressWS Form · WS Form ProCVEs relacionadas — WS Form LITE – Drag & Drop Contact Form…
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23987—WS Form < 1.8.176 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5424MEDIUMWS Form LITE <= 1.9.217 - Unauthenticated CSV InjectionEPSS 0.5%CVE-2023-52135HIGHWordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-13509HIGHWS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%