CVE-2022-2187

MEDIUM NUCLEI

Contact Form 7 Captcha <0.1.2 - XSS

Title source: llm

Description

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Nuclei Templates (1)

WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting

MEDIUMby For3stCo1d

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d

Scores

CVSS v3 6.1

EPSS 0.0270

EPSS Percentile 85.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

contact_form_7_captcha_project/contact_form_7_captcha < 0.1.2

Published Jul 17, 2022

Tracked Since Feb 18, 2026