Call Now Accessibility Button < 1.1 – Admin+ Stored Cross Site Scripting | CVE 2023-2028 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. In the plugin's "Quick Start" field, add the payload: `"><script>alert(/XSS/)</script>`
2. Save the changes, submit the request and you will see the XSS exploit.

Affects Plugins

accessibility-help-button

Fixed in 1.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Juampa Rodríguez

Submitter

Juampa Rodríguez

Submitter website

https://infayer.com/

Submitter twitter

Verified

Yes

WPVDB ID

0f1c1f1c-acdd-4c8a-bd5e-a21f4915e69f

Timeline

Publicly Published

2023-07-19 (about 2 years ago)

Added

2023-06-19 (about 2 years ago)

Last Updated

2023-06-19 (about 2 years ago)

Other

Published

Title

Published

2023-11-09

Title

Additional Order Filters for WooCommerce < 1.12 - Reflected XSS

Published

2022-12-27

Title

HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode

Published

2025-10-28

Title

LiteSpeed Cache < 7.6 - Reflected XSS

Published

2023-11-07

Title

Pinyin Slugs < 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2024-12-07

Title

Badgearoo <= 1.0.14 - Reflected XSS