CVE-2022-38467

MEDIUMNuclei

WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-38467 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 19, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

CRM Perks Forms – WordPress Form Builder

Browse CRM Perks / CRM Perks Forms – WordPress Form Builder

Default status: unaffected

CVE ListThrough 1.1.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMCRM Perks Forms < 1.1.1 - Cross Site ScriptingCVSS 6.1

The plugin does not sanitise and escape some parameters from a sample file before outputting them back in the page, leading to Reflected Cross-Site Scripting

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 1.1.1

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2022cvecrm-perks-formswpscanwordpresswpwp-pluginxsscrmperksvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:crmperks:crm_perks_forms:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4b128c9c-366e-46af-9dd2-e3a9624e3a53 https://wordpress.org/plugins/crm-perks-forms/ https://nvd.nist.gov/vuln/detail/CVE-2022-38467 https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2