CVE-2022-0248

Deeper analysis

The Contact Form Submissions WordPress plugin before version 1.7.3 is affected by a stored cross-site scripting vulnerability tracked as CVE-2022-0248. The root cause is insufficient sanitization and escaping of additional custom fields supplied in contact form submissions, which are later rendered without encoding when an administrator views the stored submission record. The flaw is classified under CWE-79 and carries a CVSS 3.1 score of 6.1.

An unauthenticated remote attacker can submit a contact form containing malicious JavaScript in one or more additional fields. When an administrator subsequently reviews the submission through the plugin’s administrative interface, the script executes in the administrator’s browser context, enabling actions such as session hijacking, administrative action forgery, or further plugin or site compromise.

Public references point to the official plugin changeset that implements input sanitization and output escaping, along with the corresponding WPScan advisory. Site operators are therefore advised to update the Contact Form Submissions plugin to version 1.7.3 or later to eliminate the exposure. The associated EPSS score has remained flat at 0.1482 with no material post-disclosure increase.