Stored Cross-Site Scripting Vulnerability in Contact Form and Calls To Action Plugin by vcita

CVE-2023-2302

What is CVE-2023-2302?

The Contact Form and Calls To Action plugin by vcita for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'email' parameter. This vulnerability allows authenticated users with edit_posts capabilities, such as contributors, to inject malicious scripts into web pages. When a user accesses an infected page, the injected script can execute, potentially compromising user data and site integrity.

References