Skip to content
Sign in
4.8 Medium

CVE-2022-23179 The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields…

Description

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Affected products and versions

Product Affected versions Fixed in
Contact Form & Lead Form Elementor Builder 1.7 earliest → < 1.7.0 1.7.0

Other CVEs of Contact Form & Lead Form Elementor Builder

The 3 CVEs of Contact Form & Lead Form Elementor Builder →
CVE-2022-23180 The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce… 4.3 Medium CVE-2021-24967 The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead… Not rated
Track this CVE