CVE-2022-0402 Superforms < 6.0.4 - Reflected Cross-Site Scripting

2024-01-1615:51:00

WPScan

www.cve.org

super forms wordpress plugin

reflected cross-site scripting

csrf

EPSS

0.001

Percentile

17.0%

JSON

The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Super Forms - Drag & Drop Form Builder",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "6.0.4"
      }
    ],
    "defaultStatus": "unaffected"
  }
]