CVE-2022-23987

CVE-2022-23987: WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting

Vendor Ws Form
Product WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Weakness CWE-79 · XSS
Published February 28, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Key dates

02Disclosure timeline

February 28, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-47977 Nuance Digital Engagement Platform Spoofing Vulnerability CVE-2023-35929 Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps CVE-2020-1673 Junos OS: Reflected Cross-site Scripting vulnerability in J-Web and web based (HTTP/HTTPS) services CVE-2025-49855 WordPress Meks Flexible Shortcodes plugin <= 1.3.7 - Cross Site Scripting (XSS) Vulnerability CVE-2024-10865 Reflected Cross-Site Scripting vulnerability in OpenText Advanced Authentication