Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2022-2187: The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Sc...
CVE-2022-2187 · published 4 years ago
Summary
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
What to do
- Update contact_form_7_captcha_project contact_form_7_captcha to version 0.1.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| contact_form_7_captcha_project | contact_form_7_captcha |
< 0.1.2 cpe:2.3:a:contact_form_7_captcha_project:contact_form_7_captcha:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Sc...
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
References
- https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Jul 2022
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2022-2187 · NVD
Track software like this
Free during beta