Stored Cross-Site Scripting in CallRail Phone Call Tracking Plugin for WordPress

CVE-2023-5051

Summary

The CallRail Phone Call Tracking plugin for WordPress is susceptible to a stored cross-site scripting vulnerability caused by insufficient input sanitization and output escaping on the 'form_id' attribute within the 'callrail_form' shortcode. This security flaw allows authenticated attackers with contributor-level permissions or higher to inject arbitrary scripts into pages. When users access these compromised pages, the injected scripts execute, potentially leading to unauthorized access, data theft, or further exploitation of the affected site.

References