CVE

CVE-2022-0879

6.1

CVSS

Description

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Attack Vector

Privileges Req.

User Interaction

caldera forms – more than contact forms

Updated Nov 7, 2026View on NVD →

This CVE is in S4E's catalog, but no public scanner is mapped to it yet.

CVE history: caldera forms – more than contact forms

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →