PT-2023-13667 · WordPress · Themekraft Post Form

Thiennv · Published 2023-03-16 · Updated 2023-03-22 · CVE-2022-38971

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin versions <= 2.7.5

Description The issue is a Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker can inject malicious scripts into the website, which will be executed by the user's browser. The vulnerability is present in the ThemeKraft Post Form plugin, which is used for user profiles and content submissions.

Recommendations For ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin versions <= 2.7.5, update to a version higher than 2.7.5 to resolve the issue. At the moment, there is no information about additional mitigation measures.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38971

Affected Products

Themekraft Post Form

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-38971 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38971 · Vendor Advisory
• https://t.me/cibsecurity/60115 · Telegram Post
• https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-7-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve · Note