CVE-2022-2187: Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-17 · updated 2026-06-17
Weakness: CWE-79

Description

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Affected products

Contact Form 7 Captcha: before 0.1.2 — fixed in 0.1.2

How to fix

Upgrade to a fixed version: Contact Form 7 Captcha 0.1.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d
https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d

Get alerted when CVE-2022-2187 or the next vulnerability affects your stack