CVE-2022-2567

CVE-2022-2567: Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site Scripting

Vendor Unknown
Product Form Builder CP
Weakness CWE-79 · XSS
Published September 19, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Key dates

02Disclosure timeline

September 19, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function CVE-2024-34752 WordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-48032 WordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-22826 WordPress Sell Digital Downloads plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability CVE-2025-71241 SPIP < 4.3.6 Cross-Site Scripting in Private Area