WS Form LITE – Drag & Drop Contact Form Builder for WordPress, CVE-2022-23987
- CVE, Research URL
- Home page URL
-
Security reports for WS Form LITE – Drag & Drop Contact Form Builder for WordPress
- Published on
- Feb 28, 2022
- Research Description
- The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Affected versions
-
Min -, max 1.8.176.
- Status
-
vulnerable