WordPress Plugin Vulnerabilities

RingCentral Communications <= 1.7.0 - Stored XSS via CSRF

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
rccp-free
No known fix

References

CVE
CVE-2024-53770
URL
https://patchstack.com/database/wordpress/plugin/rccp-free/vulnerability/wordpress-ringcentral-communications-plugin-1-6-1-csrf-to-stored-xss-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.1 (high)

Miscellaneous

Original Researcher
SOPROBRO
Verified
No
WPVDB ID
2bf0b009-c875-4a9b-964c-d3657d66ebfd

Timeline

Publicly Published
2024-11-28 (about 1 year ago)
Added
2024-12-05 (about 1 year ago)
Last Updated
2025-08-29 (about 8 months ago)

Other

Published
Title
Published
2023-09-27
Title
Woocommerce ESTO < 2.23.2 - Settings Update via CSRF
Published
2024-01-17
Title
Browser Theme Color < 1.4 - Settings Update via CSRF
Published
2025-06-05
Title
WP Page Loading < 1.0.7 - Cross-Site Request Forgery
Published
2026-04-21
Title
Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action
Published
2022-05-18
Title
Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRF