CVE-2022-1647 — Cross-site Scripting in Formcraft

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
4.8MEDIUMNVD
EPSS
0.2%
top 57.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ncrafts Formcraft
Timeline
PublishedJun 8
Latest updateNov 22

Description

The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages1 packages

▶NVDncrafts/formcraft< 1.2.6

🔴Vulnerability Details

2
GHSA
GHSA-hgx3-q35p-hgmv: The FormCraft WordPress plugin before 1↗2022-06-09
▶
CVEList
FormCraft Basic < 1.2.6 - Admin+ Stored Cross Site Scripting↗2022-06-06
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Callback Technologies CBFS Filter denial-of-service vulnerabilities↗2022-11-22
▶
Talos
Vulnerability Spotlight: Callback Technologies CBFS Filter denial-of-service vulnerabilities↗2022-11-22
▶
CVE-2022-1647 — Cross-site Scripting in Formcraft | cvebase