WordPress Plugin Vulnerabilities
Online Booking & Scheduling Calendar for WordPress by vcita < 4.5 - Subscriber+ Settings Update & Stored XSS
Description
The plugin does not apply capability checks on the vcita_save_settings_callback function, making it possible for attackers with low privileges, like subscribers, to modify the plugin's settings, upload media files, and conduct XSS attacks.
Affects Plugins
Fixed in 4.5 References
Miscellaneous
Original Researcher
Jonas Höbenreich
Verified
No
WPVDB ID
Timeline
Publicly Published
2023-06-02 (about 2 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2024-12-05 (about 1 year ago)
WPScan 