{"id":"CVE-2023-23812","state":"PUBLISHED","title":"WordPress Enhanced WP Contact Form Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)","description":"Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions.","publishedAt":"2023-05-10T07:38:57.653Z","updatedAt":"2026-04-28T16:08:02.354Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","source":"Patchstack"},"assigner":"Patchstack","products":["Joost de Valk Enhanced WP Contact Form"],"affected":[{"vendor":"Joost de Valk","product":"Enhanced WP Contact Form","packageName":"enhanced-wordpress-contactform","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.2.3","changes":[{"at":"2.3","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/vulnerability/enhanced-wordpress-contactform/wordpress-enhanced-wp-contact-form-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/23xxx/CVE-2023-23812.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-23812","state":"PUBLISHED","datePublished":"2023-05-10T07:38:57.653Z","dateUpdated":"2026-04-28T16:08:02.354Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2023-01-18T09:27:50.535Z"},"containers":{"cna":{"title":"WordPress Enhanced WP Contact Form Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)","descriptions":[{"lang":"en","value":"Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions."}],"affected":[{"vendor":"Joost de Valk","product":"Enhanced WP Contact Form","packageName":"enhanced-wordpress-contactform","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.2.3","changes":[{"at":"2.3","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/vulnerability/enhanced-wordpress-contactform/wordpress-enhanced-wp-contact-form-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:08:02.354Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Rio Darmawan (Patchstack Alliance)"}],"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability was patched in the </span><span style=\"background-color: rgb(255, 255, 255);\">2.3 version. However, you should look for alternative software as the author no longer supports this plugin, and it has been removed from the WordPress repository.</span><br>"}],"value":"The vulnerability was patched in the 2.3 version. However, you should look for alternative software as the author no longer supports this plugin, and it has been removed from the WordPress repository."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/database/vulnerability/enhanced-wordpress-contactform/wordpress-enhanced-wp-contact-form-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T10:42:26.226Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-19T20:48:36.572598Z","id":"CVE-2023-23812","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-19T21:31:11.564Z"}}]}}}