blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-23988

MEDIUM 6.1 CVSS 3.1
Published
February 28, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

Affected WordPress components

  • WS Form LITE – Drag & Drop Contact Form Builder Plugin · ws-form
    Confirmed match Active
    From 1.8.176 (including) to 1.8.176 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress — From 1.8.176 (including) to 1.8.176 (excluding)
  • WS Form WS Form Pro — From 1.8.176 (including) to 1.8.176 (excluding)
  • westguardsolutions ws_form — Before 1.8.176

References

  • wpscan.com https://wpscan.com/vulnerability/9d5738f9-9a2e-4878-8a03-745894420bf6 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record