Stored Cross-Site Scripting in CallRail Phone Call Tracking Plugin for WordPress

CVE-2023-5051

What is CVE-2023-5051?

The CallRail Phone Call Tracking plugin for WordPress is susceptible to a stored cross-site scripting vulnerability caused by insufficient input sanitization and output escaping on the 'form_id' attribute within the 'callrail_form' shortcode. This security flaw allows authenticated attackers with contributor-level permissions or higher to inject arbitrary scripts into pages. When users access these compromised pages, the injected scripts execute, potentially leading to unauthorized access, data theft, or further exploitation of the affected site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References