WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS

Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires...

EUVD-2015-8234

Malware in sbrugna...

CVE-2024-11886: Improper Neutralization of Input During Web Page Generation

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-13717: Missing Authorization

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae and vcitaajaxtogglecontact functions in all versions up to, and including, 2.7.1. This makes it possible for authenticat...

WordPress Contact Form and Calls To Action by vcita Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form and Calls To Action by vcita Type Plugin Vulnerable versions = 2.7.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2303 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 7cc1d9903a62 Credits...

CVE-2023-2302

CVE-2023-2302 affects the WordPress plugin Contact Form and Calls To Action by vcita. It is a Stored XSS via the email parameter in versions ≤ 2.6.4, requiring authenticated attackers with edit_posts capability (e.g., Contributors+) to inject scripts that run on pages visited by users. Connected ...

CVE-2023-2303: Cross-Site Request Forgery (CSRF)

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the...

CVE-2023-2302: Improper Neutralization of Input During Web Page Generation

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the...

Contact Form and Calls To Action by vcita < 2.7.1 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the email and uid parameters in the plugin settings, which could allow users with roles as low as contributor to inject arbitrary web scripts into the settings, targeting higher-privileged users such as administrators...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 open-tab parameter in a wpctaglobalsettings action to wp-admin/edit.php or 2 wp-cta-variation-id parameter to...

CVE-2015-8350

CVE-2015-8350 covers two XSS vulnerabilities in the WordPress plugin Calls to Action prior to 2.5.1. The flaws arise from unsanitized input in two GET parameters: open-tab (wp_cta_global_settings action, used in wp-admin/edit.php) and wp-cta-variation-id (in ab-testing-call-to-action-example/). T...

CVE-2015-8350

Multiple cross-site scripting XSS vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 open-tab parameter in a wpctaglobalsettings action to wp-admin/edit.php or 2 wp-cta-variation-id parameter to...

CVE-2015-8350: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 open-tab parameter in a wpctaglobalsettings action to wp-admin/edit.php or 2 wp-cta-variation-id parameter to...

WordPress Calls To Action 2.4.3 Cross Site Scripting

Advisory ID: HTB23274 Product: Calls to Action WordPress plugin Vendor: InboundNow Vulnerable Versions: 2.4.3 and probably prior Tested Version: 2.4.3 Advisory Publication: October 7, 2015 without technical details Vendor Notification: October 7, 2015 Vendor Patch: October 27, 2015 Public...

Calls to Action WordPress Plugin Reflective Cross-Site Scripting Vulnerability

Calls to Action is a plugin for calling events on WordPress sites. Calls to Action 2.4.3 and earlier versions do not effectively filter the "open-tab" HTTP GET parameter value and the "wp-cta-variation-id" HTTP GET parameter value, which allows an unauthenticated, remote attacker to trick...

WordPress Calls to Action Plugin <= 2.4.3 - Reflected Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability, because "open-tab" HTTP GET parameter is not properly sanitised. Remote attackers can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code. Solution Update the plugin...

WordPress Calls to Action <= 2.4.3 - Reflected Cross-Site Scripting (XSS)

The WordPress Calls to Action WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

Two Reflected XSS Vulnerabilities in Calls to Action WordPress plugin

High-Tech Bridge Security Research Lab discovered two Cross-Site Scripting XSS vulnerabilities in a popular WordPress plugin Calls to Action. A remote attacker might be able to steal user's and administrator’s cookies, credentials and browser history, modify web page content to perform phishing...

WordPress Calls to Action Plugin <= 2.2.7 - Stored XSS

Unauthenticated users can update the content of any specific form on the site by the AJAX action "inboundformsave". Solution Update the plugin...

WordPress Calls to Action <= 2.2.7 - Stored XSS

The AJAX action ‘inboundformsave’ allows unauthenticated users to update the content of any specific form on the site. In order to exploit this, a form ID must be enumerated using another unauthenticated AJAX action, ‘inboundgetformdata’. Once a form ID has been enumerated, the content of the for...