In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Reflected Cross-Site Scripting in Contact Form 7 Captcha

Automattic’s WPScan made this claim about a supposed reflected cross-site scripting vulnerability in the plugin Contact Form 7 Captcha:

The plugin does not escape the $_SERVER[‘REQUEST_URI’] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

So what web browsers would those be? They don’t say.

That might have to do with the fact that modern web browsers encode characters in URLs, which restricts this being a vulnerability, as well as any web browsers following the standard related to that, RFC 3986. Unless they can point to a reasonable scenario where this would be exploitable, this would be more accurately described as a possible or a potential vulnerability.

This false report was given a CVE id by WPScan, CVE-2022-2187, despite not really being a vulnerability.