Multiple plugins by vcita - Contributor+ Stored Cross-Site Scripting

2023-06-0200:00:00

wpvulndb

vcita plugin

stored cross-site scripting

live-site-parse-vcita-callback

exploit

security vulnerability

0.004 Low

EPSS

Percentile

73.3%

JSON

The plugin does not sanitize and the email field in the plugin settings, which could allow users with roles as low as contributor to inject arbitrary web scripts in the plugin settings page, which could target high privilege users such as administrators.

https://example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a“/><script>alert(1);</script>&uid=a