CVE-2022-0248: 
WordPress vulnerability analysis and mitigation

The Contact Form Submissions WordPress plugin before version 1.7.3 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-0248. The vulnerability was discovered and publicly disclosed on February 21, 2022. This security issue affects WordPress installations using the Contact Form Submissions plugin versions prior to 1.7.3 (WPScan).

The vulnerability stems from improper sanitization and escaping of additional fields in contact form requests before they are output in the related submission. The vulnerability has been assigned a CVSS score of 8.8 (High), and is classified as CWE-79 (Cross-Site Scripting). The issue falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, this vulnerability allows unauthenticated attackers to perform Cross-Site Scripting attacks against administrators who view malicious submissions. The stored XSS payload is triggered when an administrator views the compromised submission in the WordPress dashboard (WPScan).

The vulnerability has been patched in version 1.7.3 of the Contact Form Submissions plugin. Website administrators are advised to update to this version or later to mitigate the risk (WordPress Plugin Tracker).