CVE-2022-38467

Deeper analysis

The vulnerability CVE-2022-38467 is a reflected cross-site scripting issue, tracked as CWE-79, that affects the CRM Perks Forms WordPress form builder plugin in versions up to and including 1.1.0. It carries a CVSS 3.1 base score of 6.1 reflecting network attack vector, low attack complexity, no required privileges, required user interaction, and changed scope with limited confidentiality and integrity consequences.

An unauthenticated remote attacker can supply a crafted request that is reflected back to a victim user; when the victim follows the link, attacker-controlled script executes in the victim's browser session, enabling actions such as data theft or unauthorized operations within the affected WordPress site.

The associated EPSS probability reached a peak of 0.1768 before settling at the current value of 0.1213, demonstrating a material rise from a low baseline that indicates growing exploitation interest after public disclosure.