Back to Database
Status published
Medium
CVE-2022-23988
WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting
Vulnerability Description
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23988
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Felipe Restrepo Rodriguez
Affected Vendor
WS Form
View all reports →Affected Software
WS Form LITE – Drag & Drop Contact Form Builder for WordPress, WS Form Pro
Vulnerable Versions:
1.8.176
Timeline
Official Publish:
February 28th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N