Medium severity6.1NVD Advisory· Published Mar 14, 2022· Updated Jun 17, 2026

CVE-2022-0248

Description

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Contact Form Submissions WordPress plugindescription
WordPress/Simpleform Contact Form Submissionsllm-fuzzy
Range: <1.7.3
Package: https://wordpress.org/plugins/simpleform-contact-form-submissions

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2682024nvdPatchThird Party Advisory
wpscan.com/vulnerability/d02cf542-2d75-46bc-a0df-67bbe501cc89nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000