Lucene search
WpvulndbWPVDB-ID:EECA4228-7239-4064-8B7C-7EEA2ECE3CD0HistoryJun 02, 2023 - 12:00 a.m.
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.3 - Missing Capability Checks
2023-06-0200:00:00
wpscan.com
3
vcita
wordpress
capability checks
attackers
xss
security vulnerability
0.001 Low
EPSS
Percentile
39.5%
The plugin does not apply capability checks on the vcita_save_settings_callback function, making it possible for attackers with low privileges, like subscribers, to modify the plugin’s settings, upload media files, and conduct XSS attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| meeting-scheduler-by-vcita | eq | * |
Related
prion
prion
Design/Logic Flaw
2023-06-09 06:16:00
cvelist
cvelist
CVE-2023-2414
2023-06-09 05:33:14
cve
cve
CVE-2023-2414
2023-06-09 06:16:07
nvd
nvd
CVE-2023-2414
2023-06-09 06:16:07
wordfence
wordfence