Stored Cross-Site Scripting Vulnerability in CRM and Lead Management by vcita Plugin
CVE-2023-2404
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 3 June 2023
What is CVE-2023-2404?
The CRM and Lead Management by vcita plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping, specifically via the 'email' parameter. This vulnerability allows authenticated users with edit_posts capabilities, such as contributors, to embed arbitrary web scripts into pages. Consequently, these scripts will execute every time a user accesses affected pages, potentially leading to significant security risks and exploitation.
Affected Version(s)
CRM and Lead Management by vcita * <= 2.6.2