Stored Cross-Site Scripting Vulnerability in Event Registration Calendar and Online Payments Plugins by vcita

CVE-2023-2406

What is CVE-2023-2406?

The Event Registration Calendar by vcita plugin and the Online Payments plugin for WordPress are susceptible to stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping in the 'email' parameter. Authenticated attackers with the capability to edit posts can exploit this vulnerability to inject arbitrary web scripts. These scripts will execute whenever a user accesses an affected page, leading to potential unauthorized actions or data disclosure. Users are strongly urged to upgrade to secure versions to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References