CVE-2023-2302 - Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published Jun 3, 2023

6.4

MEDIUM

CVSS 3.1

EPSS 0.52%

Description

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

Vendor Vcita Product Contact Form and Calls To Action by vcita Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=2.6.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vcita

Contact Form and Calls To Action by vcita

unaffected

Version	Status	Constraints
0	affected	<=2.6.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

Link	Providers	Tags
https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita		Third Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33808		Advisory
https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php		Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2933281%40lead-capturing-call-to-actions-by-vcita%2Ftrunk&old=2748059%40lead-capturing-call-to-actions-by-vcita%2Ftrunk&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc237a-9157-4da9-ba8f-9daf2ba4f20b?source=cve		Third Party Advisory