CVE-2022-2187: Contact Form 7 Captcha Project Contact Form 7 Captcha

Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days.

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Affected products

• Contact Form 7 Captcha Project Contact Form 7 Captcha: before 0.1.2 (fixed in 0.1.2)

Published 2022-07-17. Last modified 2026-06-17.