CVE-2022-2187

Deeper analysis

The Contact Form 7 Captcha WordPress plugin before version 0.1.2 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is a failure to escape the $_SERVER['REQUEST_URI'] value before echoing it into an HTML attribute, which permits script injection when the page is rendered in older web browsers. The issue carries a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can supply a crafted URI that is reflected back to a victim who follows a malicious link or visits a compromised page. Successful exploitation results in execution of attacker-controlled script in the victim's browser context, enabling limited theft or manipulation of data within the affected site's origin.

The EPSS score for this CVE rose from a low baseline to a peak of 0.0777 on 2025-12-11 before receding to the current value of 0.0270, indicating a period of increased exploitation interest after disclosure. The listed references point to a WPScan advisory that identifies the vulnerable plugin versions but provides no additional mitigation details beyond the version information already present in the CVE description.