CVE

CVE-2022-0879

6.1

CVSS

Description

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Attack Vector

Privileges Req.

User Interaction

caldera forms – more than contact forms

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Caldera Forms WordPress plugin References: https://nvd.nist.gov/vuln/detail/CVE-2022-0879 https://wpscan.com/vulnerability/10e8e92a-4e1d-4e9c-8b3e-e8c5e0e0e0e0 https://github.com/20142995/nuclei-templates Remediation: Update to version 1.9.7 or later.

url

Scanner page →Run scanner

CVE history: caldera forms – more than contact forms

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →