Name: CVE-2022-23988: Improper Neutralization of Input During Web Page Generation
Published: 2022-02-28T00:00:00.000Z
Keywords: CVE, CVE-2022-23988, CWE-79, CVSS 6.1, EPSS 0.02196

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

CVSS Details

CVSS 3.1 Base Score: 6.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Ws Form Plugin	View advisory ↗View advisory ↗View advisory ↗	ws-form-plugin-cve-2022-23988	May 15, 2025	Jan 31, 2022
Ws Form Pro Plugin	View advisory ↗View advisory ↗View advisory ↗	ws-form-pro-plugin-cve-2022-23988	May 15, 2025	Jan 31, 2022

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub