CVE-2022-40191

Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

Score

CVSS 3.1 5.4 Medium

Status

Modified - audit@patchstack.com

Published

2022-09-09

Last modified

2026-04-28

Weaknesses

CWE-79

Affected products

• Contact Form By Mega Forms Wordpress Plugin (Ali Khallad)
• Contact Form By Mega Forms (Contact Form By Mega Forms Project)

References

• https://patchstack.com/database/vulnerability/mega-forms/wordpress-contact-form-by-mega-forms-plugin-1-2-4-authenticate…
• https://wordpress.org/plugins/mega-forms/#developers