Stored Cross-Site Scripting Vulnerability in Event Registration Calendar and Online Payments Plugins by vcita
CVE-2023-2406

5.4MEDIUM

Summary

The Event Registration Calendar by vcita plugin and the Online Payments plugin for WordPress are susceptible to stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping in the 'email' parameter. Authenticated attackers with the capability to edit posts can exploit this vulnerability to inject arbitrary web scripts. These scripts will execute whenever a user accesses an affected page, leading to potential unauthorized actions or data disclosure. Users are strongly urged to upgrade to secure versions to mitigate this risk.

Affected Version(s)

Event Registration Calendar By vcita * <= 1.3.1

Online Payments – Get Paid with PayPal, Square & Stripe * <= 3.9.1

References

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonas Höbenreich
.