WS Form LITE <= 1.8.175 is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated

Published
2022-01-30

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

CVE

https://www.cve.org/CVERecord?id=CVE-2022-23988

CVSS

Score:6.1

Severity:Medium

Version: 1.8.175

There is a patch available in v1.8.176 and we strongly recommend you update to this version as soon as possible.