WordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)
CVE-2022-36796

6.1MEDIUM

Key Information:

Vendor: WordPress
Status: Callrail Phone Call Tracking (WordPress Plugin)
Vendor: CVE Published:; 1 September 2022

Summary

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at WordPress.

Affected Version(s)

CallRail Phone Call Tracking (WordPress plugin) <= 0.4.9 <= 0.4.9

References

https://patchstack.com/database/vulnerability/callrail-ph...

x_refsource_CONFIRM

https://wordpress.org/plugins/callrail-phone-call-tracking/

x_refsource_CONFIRM

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Sep 1, 2022
Vulnerability Reserved
Aug 9, 2022

Credit

Vulnerability discovered by Rasi Afeef (Patchstack Alliance)