Read the docs
TI-2022-07951 Aliases CVE-2022-23988GHSA-j8j2-69r7-q88p

WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

Why it matters now

EPSS 0.02231 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WS Form LITE – Drag & Drop Contact Form Builder for WordPress (WS Form): 1.8.176WS Form Pro (WS Form): 1.8.176

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WS FormWS Form LITE – Drag & Drop Contact Form Builder for WordPress1.8.176 to before 1.8.1761.8.176Patch availableCNA
WS FormWS Form Pro1.8.176 to before 1.8.1761.8.176Patch availableCNA
  • WS Form LITE – Drag & Drop Contact Form Builder for WordPress VendorWS Form Affected 1.8.176 to before 1.8.176 Fixed in 1.8.176 Patch available CNA
  • WS Form Pro VendorWS Form Affected 1.8.176 to before 1.8.176 Fixed in 1.8.176 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:lite:wordpress:*:*before 1.8.176VulnerableWS Form
cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:pro:wordpress:*:*before 1.8.176VulnerableWS Form
  • cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:lite:wordpress:*:* Versions before 1.8.176 Vulnerable ·WS Form
  • cpe:2.3:a:westguardsolutions:ws_form:*:*:*:*:pro:wordpress:*:* Versions before 1.8.176 Vulnerable ·WS Form

Remediation

  • Fix · CNA WS Form LITE – Drag & Drop Contact Form Builder for WordPress (WS Form) Fixed in 1.8.176
  • Fix · CNA WS Form Pro (WS Form) Fixed in 1.8.176

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WS Form LITE – Drag & Drop Contact Form Builder for WordPress, WS Form Pro 1.8.176

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-07950 WS Form < 1.8.176 - Admin+ Stored Cross-Site ScriptingPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23988
  2. 2026-10-03 Alias added: GHSA-j8j2-69r7-q88p

References

Exploit 1

  • TI-2023-04993 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection CVSS 3.1HIGH 8.8
  • TI-2024-12550 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
  • TI-2023-28574 WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection CVSS 3.1HIGH 7.6
  • TI-2024-09865 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL CVSS 3.1MEDIUM 6.1
  • TI-2022-07950 WS Form < 1.8.176 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences