CVE-2022-29408 - OpenCVE

Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vsourz	Advanced Cf7 Db

Configuration 1 [-]

cpe:2.3:a:vsourz:advanced_cf7_db:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/advanced-cf7-db/wordpress-advanced-contact-form-7-db-plugin-1-8-7-persistent-cross-site-scripting-xss-vulnerability
https://wordpress.org/plugins/advanced-cf7-db/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2022-05-25T15:58:26.224139Z

Updated: 2024-09-16T16:53:46.625Z

Reserved: 2022-04-18T00:00:00

Link: CVE-2022-29408

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-05-25T16:15:08.350

Modified: 2022-06-01T00:13:12.740

Link: CVE-2022-29408

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Advanced Contact form 7 DB (WordPress plugin)", "vendor": "Vsourz Digital", "versions": [{"lessThanOrEqual": "1.8.7", "status": "affected", "version": "<= 1.8.7", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Vulnerability discovered by BEE-K (Patchstack)"}], "datePublic": "2022-04-21T00:00:00", "descriptions": [{"lang": "en", "value": "Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-25T15:58:26", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/advanced-cf7-db/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://patchstack.com/database/vulnerability/advanced-cf7-db/wordpress-advanced-contact-form-7-db-plugin-1-8-7-persistent-cross-site-scripting-xss-vulnerability"}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2022-04-21T14:19:00.000Z", "ID": "CVE-2022-29408", "STATE": "PUBLIC", "TITLE": "WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Advanced Contact form 7 DB (WordPress plugin)", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 1.8.7", "version_value": "1.8.7"}]}}]}, "vendor_name": "Vsourz Digital"}]}}, "credit": [{"lang": "eng", "value": "Vulnerability discovered by BEE-K (Patchstack)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wordpress.org/plugins/advanced-cf7-db/", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/advanced-cf7-db/"}, {"name": "https://patchstack.com/database/vulnerability/advanced-cf7-db/wordpress-advanced-contact-form-7-db-plugin-1-8-7-persistent-cross-site-scripting-xss-vulnerability", "refsource": "CONFIRM", "url": "https://patchstack.com/database/vulnerability/advanced-cf7-db/wordpress-advanced-contact-form-7-db-plugin-1-8-7-persistent-cross-site-scripting-xss-vulnerability"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:17:55.067Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/plugins/advanced-cf7-db/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/advanced-cf7-db/wordpress-advanced-contact-form-7-db-plugin-1-8-7-persistent-cross-site-scripting-xss-vulnerability"}]}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2022-29408", "datePublished": "2022-05-25T15:58:26.224139Z", "dateReserved": "2022-04-18T00:00:00", "dateUpdated": "2024-09-16T16:53:46.625Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vsourz:advanced_cf7_db:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "C7815A3E-A124-4034-B1CC-8DCD718E8DF2", "versionEndIncluding": "1.8.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress."}, {"lang": "es", "value": "Una vulnerabilidad persistente de tipo cross-Site Scripting (XSS) en el plugin Advanced Contact form 7 DB de Vsourz Digital versiones anteriores a 1.8.7 incluy\u00e9ndola, en WordPress"}], "id": "CVE-2022-29408", "lastModified": "2022-06-01T00:13:12.740", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2022-05-25T16:15:08.350", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/advanced-cf7-db/wordpress-advanced-contact-form-7-db-plugin-1-8-7-persistent-cross-site-scripting-xss-vulnerability"}, {"source": "audit@patchstack.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/advanced-cf7-db/"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}