Stored Cross-Site Scripting Vulnerability in Event Registration Calendar and Online Payments Plugins by vcita
CVE-2023-2406
5.4MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 3 June 2023
Summary
The Event Registration Calendar by vcita plugin and the Online Payments plugin for WordPress are susceptible to stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping in the 'email' parameter. Authenticated attackers with the capability to edit posts can exploit this vulnerability to inject arbitrary web scripts. These scripts will execute whenever a user accesses an affected page, leading to potential unauthorized actions or data disclosure. Users are strongly urged to upgrade to secure versions to mitigate this risk.
Affected Version(s)
Event Registration Calendar By vcita * <= 1.3.1
Online Payments – Get Paid with PayPal, Square & Stripe * <= 3.9.1
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jonas Höbenreich