CVE-2023-2405: CRM and Lead Management by vcita <= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.2. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Other sources
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2405.
What is the severity rating of CVE-2023-2405?
CVE-2023-2405 has a severity rating of medium.
What is the affected software for CVE-2023-2405?
The affected software for CVE-2023-2405 is the CRM and Lead Management by vcita plugin for WordPress versions up to and including 2.6.2.
What is the cause of CVE-2023-2405?
CVE-2023-2405 is caused by missing nonce validation in the vcita-callback.php file of the CRM and Lead Management by vcita plugin for WordPress.
How can unauthenticated attackers exploit CVE-2023-2405?
Unauthenticated attackers can exploit CVE-2023-2405 to modify the plugin's settings.