Back to Database
Status published
Medium
CVE-2022-23987
WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting
Vulnerability Description
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23987
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Felipe Restrepo Rodriguez
Affected Vendor
WS Form
View all reports →Affected Software
WS Form LITE – Drag & Drop Contact Form Builder for WordPress, WS Form Pro
Vulnerable Versions:
1.8.176
Timeline
Official Publish:
February 28th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N