CVE-2022-23987 WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting

What is CVE-2022-23987?

CVE-2022-23987 is a medium-severity cross-site scripting vulnerability in WS Form LITE – Drag & Drop Contact Form Builder for WordPress, published on 28 Feb 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Weakness: CWE-79

Which versions are affected by CVE-2022-23987?

It affects 1 product.

Products include Westguardsolutions Ws Form.

How do I fix CVE-2022-23987?

No fix has been published for CVE-2022-23987 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-23987 being exploited?

There is no known exploitation of CVE-2022-23987 in the wild and no public exploit code.

Other vulnerabilities in WS Form LITE – Drag & Drop Contact Form Builder for WordPress

• CVE-2023-52135 WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection High 7.6
• CVE-2024-13509 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2024-10647 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL Medium 6.1
• CVE-2022-23988 WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting Medium 6.1
• CVE-2023-5424 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4393-ch2m-6pmx.