Medium severity · published Mar 16, 2023
CVE-2022-38971
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5…
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Post Form Registration Form Profile Form For User Profiles And Content Forms · Themekraft
through 2.7.5 · source: NVD
Affected product
PF
Post Form Registration Form Profile Form For User Profiles And Content Forms
Themekraft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38971
Third Party Advisory
https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-7-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
More from Post Form Registration Form Profile Form For User Profiles And Content Forms
8.8
CVE-2024-8246
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation
5.3
CVE-2024-5149
BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness