CVE-2022-23988 WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting
Unauthenticated attackers can inject malicious scripts via form submissions that execute when privileged users view the data, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-23988?
CVE-2022-23988 is a medium-severity cross-site scripting vulnerability in WS Form LITE – Drag & Drop Contact Form Builder for WordPress, published on 28 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Weakness: CWE-79
Which versions are affected by CVE-2022-23988?
It affects 1 product.
Products include Westguardsolutions Ws Form.
How do I fix CVE-2022-23988?
No fix has been published for CVE-2022-23988 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-23988 being exploited?
There is no known exploitation of CVE-2022-23988 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in WS Form LITE – Drag & Drop Contact Form Builder for WordPress
- CVE-2023-52135 WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection
- CVE-2024-13509 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-10647 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL
- CVE-2022-23987 WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting
- CVE-2023-5424 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection
Sources
Also known as GHSA-j8j2-69r7-q88p.