CVE-2022-40191: Contact Form By Mega Forms Project Contact Form By Mega Forms

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

Affected products

• Contact Form By Mega Forms Project Contact Form By Mega Forms: up to and including 1.2.4

Published 2022-09-09. Last modified 2026-06-17.