PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-50959 Wordpress CVE debrief

CVE-2022-50959 describes a reflected cross-site scripting issue in the WordPress Contact Form Builder plugin, version 1.6.1. The vulnerable behavior is tied to the form_id parameter in code_generator.php, where an attacker can supply a crafted URL that causes arbitrary JavaScript to run in a victim’s browser. Because the issue is unauthenticated and browser-triggered, the main risk is session theft, account impersonation, or malicious actions performed in the context of an affected user viewing the link.

Vendor
Wordpress
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-10
Original CVE updated
2026-07-24
Advisory published
2026-05-10
Advisory updated
2026-07-24

Who should care

Administrators and security teams responsible for WordPress sites that use the Contact Form Builder plugin, especially public-facing sites or sites where privileged users may open externally supplied links.

Technical summary

The supplied corpus identifies a reflected XSS condition in Contact Form Builder 1.6.1. The attack surface is the form_id parameter passed to code_generator.php. If application output is not properly escaped or sanitized, attacker-controlled input can be reflected into the response and executed as script in the browser of a user who visits a maliciously crafted URL. The CVE is rated CVSS 5.1 (MEDIUM) and uses CWE-79.

Defensive priority

Medium. Treat as higher priority if the plugin is installed on a production WordPress site or if administrators/editor accounts may click untrusted links.

Recommended defensive actions

  • Verify whether WordPress Contact Form Builder is installed and whether version 1.6.1 or another affected release is in use.
  • Update to a vendor-fixed version if one is available; if no fixed release is available, remove or disable the plugin until remediation is possible.
  • Restrict access to the plugin’s admin-facing pages and minimize exposure of privileged users to untrusted external links.
  • Review web application logging and browser-side incident reports for suspicious requests to code_generator.php with crafted form_id values.
  • Apply general XSS hardening controls such as output encoding, input validation, and a strong Content Security Policy where practical.

Evidence notes

This debrief is based only on the supplied CVE corpus and the linked official records/references. The CVE description states the vulnerable component, version, parameter, and reflected XSS behavior. NVD metadata lists CWE-79 and references the WordPress plugin page, an Exploit-DB entry, and a VulnCheck advisory. No exploit steps or payload details are included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-50959 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-50959

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-50959 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-50959

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.