CVE-2023-2302

🗓️ 03 Jun 2023 04:35:14Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2023-2302	3 Jun 202305:15	–	attackerkb
CNNVD	WordPress plugin Contact Form and Calls To Action by vcita 跨站脚本漏洞	3 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-2302 Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	3 Jun 202304:35	–	cvelist
EUVD	EUVD-2023-33808	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2302	3 Jun 202305:15	–	nvd
Patchstack	WordPress Contact Form and Calls To Action by vcita Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)	5 Jun 202300:00	–	patchstack
Prion	Cross site scripting	3 Jun 202305:15	–	prion
Positive Technologies	PT-2023-18822 · Vcita · Contact Form/Calls To Action	3 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-2302	23 May 202501:51	–	redhatcve
Vulnrichment	CVE-2023-2302 Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	3 Jun 202304:35	–	vulnrichment

NVD

Vulners

Node

vcita contact_form_and_calls_to_action_by_vcitaRange≤2.6.4wordpress

[
  {
    "vendor": "vcita",
    "product": "Contact Form and Calls To Action by vcita",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.6.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
blog	www.blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4dfc237a-9157-4da9-ba8f-9daf2ba4f20b
plugins	www.plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-callback.php

Parameter	Position	Path	Description	CWE
email	query param	wp-admin/admin.php?page=lead-capturing-call-to-actions-by-vcita/vcita-callback.php	Stored Cross-Site Scripting via unsanitized email/uid parameters in plugin settings.	CWE-79
uid	query param	wp-admin/admin.php?page=lead-capturing-call-to-actions-by-vcita/vcita-callback.php	Stored Cross-Site Scripting via unsanitized email/uid parameters in plugin settings.	CWE-79

08 Apr 2026 18:18Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4 - 6.4

EPSS0.00338

SSVC

CWE-79