CVE-2022-2187

MEDIUMNuclei

Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-2187 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Contact Form 7 Captcha

CVE List0.1.2 to < 0.1.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Contact Form 7 Captcha <0.1.2 - Cross-Site ScriptingCVSS 6.1

WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update the WordPress Contact Form 7 Captcha plugin to version 0.1.2 or later to mitigate the XSS vulnerability.

WeaknessesCWE-79
AuthorsFor3stCo1d
Template tagscvecve2022wpscanwordpressxsswp-pluginwpcontact_form_7_captcha_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:contact_form_7_captcha_project:contact_form_7_captcha:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d https://wordpress.org/plugins/contact-form-7-simple-recaptcha https://nvd.nist.gov/vuln/detail/CVE-2022-2187 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2