CVE-2022-38971

MEDIUM 5.4CVE-2022-38971 · Published 16/03/2023 · updated 17/06/2026

In short

CVE-2022-38971 is a MEDIUM (CVSS 5.4) vulnerability affecting post form registration form profile form for user profiles and content forms (themekraft).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
post form registration form profile form for user profiles and content forms themekraft	`≤ 2.7.5`	No fix yet

Description

Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.

References

patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-7-2-auth-stored-cross-site-scripting-xss-vulnerability · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free