{"id":"CVE-2022-23179","aliases":["EUVD-2022-28270","GHSA-h9pp-v4f3-fp7x"],"status":"published","title":"Contact Form \u0026 Lead Form Elementor Builder \u003c 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting","description":"The Contact Form \u0026 Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00536,"percentile":0.45625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-01-16T15:52:09Z","modified":"2026-06-17T04:29:37Z","products":[{"vendor":"themehunk","product":"contact form \u0026 lead form elementor builder"},{"vendor":"themehunk","product":"contact_form_\\\u0026_lead_form_elementor_builder"},{"vendor":"unknown","product":"contact form \u0026 lead form elementor builder"}],"references":[{"url":"https://wpscan.com/vulnerability/90b8af99-e4a1-4076-99fa-efe805dd4be4/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23179"},{"url":"https://wpscan.com/vulnerability/90b8af99-e4a1-4076-99fa-efe805dd4be4"},{"url":"https://github.com/advisories/GHSA-h9pp-v4f3-fp7x"}],"sources":{"cve":[{"id":"CVE-2022-23179","title":"Contact Form \u0026 Lead Form Elementor Builder \u003c 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting","description":"The Contact Form \u0026 Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed","status":"published","published":"2024-01-16T15:52:09.488Z","modified":"2026-01-09T21:03:33.289Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-28270","description":"The Contact Form \u0026 Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed","status":"published","published":"2024-01-16T15:52:09Z","modified":"2026-01-09T21:03:33Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:53.623536Z"}],"ghsa":[{"id":"GHSA-h9pp-v4f3-fp7x","title":"The Contact Form \u0026 Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some...","description":"The Contact Form \u0026 Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed","status":"published","published":"2024-01-16T18:31:09Z","modified":"2025-05-09T18:31:40Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:13.681205Z"}],"nvd":[{"id":"CVE-2022-23179","description":"The Contact Form \u0026 Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed","status":"published","published":"2024-01-16T16:15:09.737Z","modified":"2026-06-17T04:29:37.993Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:40.49892Z"}]}}