blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-0402

MEDIUM 6.1 CVSS 3.1
Published
January 16, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.

Affected products and versions

  • Unknown Super Forms - Drag & Drop Form Builder — Before 6.0.4
  • super-forms super_forms — Before 6.0.4

References

  • github.com https://github.com/RensTillmann/super-forms/commit/c19d65abbe43d9b6359c1bf3498dc697d0c19d02 Patch
  • wpscan.com https://wpscan.com/vulnerability/2e2e2478-2488-4c91-8af8-69b07783854f/ Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record