WordPress Plugin Vulnerabilities

Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Admin+ Stored XSS

Description

The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
catalyst-connect-client-portal
Fixed in 2.1.0

References

CVE
CVE-2022-44629
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/catalyst-connect-client-portal/catalyst-connect-zoho-crm-client-portal-200-authenticated-administrator-stored-cross-site-scripting

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Hoang Van Hiep aka sk4rl1ghT
Verified
No
WPVDB ID
c67cbd36-36df-4b5d-8b49-e87f12dadede

Timeline

Publicly Published
2023-06-27 (about 2 years ago)
Added
2023-08-10 (about 2 years ago)
Last Updated
2023-08-10 (about 2 years ago)

Other

Published
Title
Published
2023-01-30
Title
Real Media Library < 4.18.29 - Author+ Stored XSS
Published
2024-11-29
Title
GTPayment Donations <= 1.0.0 - Stored XSS via CSRF
Published
2025-04-04
Title
AI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2023-07-17
Title
MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS
Published
2024-01-17
Title
MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS