CVE-2022-25601

🗓️ 11 Mar 2022 17:54:08Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 134 Views🌐 WEB

CVE-2022-25601 XSS vulnerability in Contact Form X WordPress plugin

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2022-25601	11 Mar 202220:15	–	circl
CNNVD	WordPress plugin Contact Form X跨站脚本漏洞	11 Mar 202200:00	–	cnnvd
CNVD	WordPress Contact Form X plugin cross-site scripting vulnerability	15 Mar 202200:00	–	cnvd
Cvelist	CVE-2022-25601 WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability	11 Mar 202217:54	–	cvelist
EUVD	EUVD-2022-30261	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 34 Update: wordpress-5.8.4-1.fc34	18 Mar 202219:14	–	fedora
Fedora	[SECURITY] Fedora 35 Update: wordpress-5.9.2-1.fc35	18 Mar 202220:08	–	fedora
Fedora	[SECURITY] Fedora 36 Update: wordpress-5.9.2-1.fc36	26 Mar 202215:47	–	fedora
NVD	CVE-2022-25601	11 Mar 202218:15	–	nvd
OpenVAS	Fedora: Security Advisory for wordpress (FEDORA-2022-4b3079c1be)	23 Mar 202200:00	–	openvas

NVD

Vulners

Node

plugin-planet contact_form_xRange<2.4.1wordpress

Node

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

[
  {
    "product": "Contact Form X (WordPress plugin)",
    "vendor": "Jeff Starr",
    "versions": [
      {
        "lessThanOrEqual": "2.4",
        "status": "affected",
        "version": "<= 2.4",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/
patchstack	www.patchstack.com/database/vulnerability/contact-form-x/wordpress-contact-form-x-plugin-2-4-authenticated-reflected-cross-site-scripting-xss-vulnerability
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJX6NVXSRN3RX3YUVEJQ4WUTQSDL3DSR/
wordpress	www.wordpress.org/plugins/contact-form-x/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZQCIZQI267YHVYSFB3CRKNK3F4ASPLK/

Parameter	Position	Path	Description	CWE
tab	query param	wp-admin/options-general.php	Reflected XSS via tab parameter not escaped in output within an attribute	CWE-79

28 Apr 2026 16:07Current

5.2Medium risk

Vulners AI Score5.2

CVSS 24.3

CVSS 3.14.7 - 6.1

EPSS0.00332

SSVC

CWE-79