CVE-2022-4226: The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scri

medium Affects simple-basic-contact-form (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2022-12-26; advisory modified 2026-06-17.

The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scri

Package: simple-basic-contact-form (WordPress plugin) WordPress
Affected versions: <20221201
Fixed in: 20221201
Severity: medium CVSS 4.8
Exploitation: not on CISA KEV · EPSS 1% (46.4th percentile)
Published: 2022-12-26
Source: nvd

References

NVD record simple-basic-contact-form (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-12716 medium The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escap same package: simple-basic-contact-form (WordPress plugin)
CVE-2022-24086 KEV critical Magento improper input validation vulnerability also from 2022
CVE-2022-39986 critical RaspAP Command Injection vulnerability also from 2022
CVE-2022-24637 critical Improper Privilege Management in Open Web Analytics also from 2022
CVE-2022-21661 high WordPress is a free and open-source content management system written in PHP and paired wi also from 2022
CVE-2022-3562 medium Cross-site Scripting in librenms/librenms also from 2022