CVE-2022-38467

2023-01-1411:15:09

CWE-79

Patchstack

web.nvd.nist.gov

cve

2022

38467

xss

vulnerability

crm

perks

forms

wordpress

form builder

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

35.3%

JSON

Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.

Affected configurations

Nvd

Vulners

Node

crmperkscrm_perks_formsRange≤1.1.0wordpress

VendorProductVersionCPE
crmperkscrm_perks_forms*cpe:2.3:a:crmperks:crm_perks_forms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
crmperks	crm_perks_forms	*	cpe:2.3:a:crmperks:crm_perks_forms::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "product": "CRM Perks Forms – WordPress Form Builder",
    "vendor": "CRM Perks",
    "versions": [
      {
        "changes": [
          {
            "at": "1.1.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.1.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve