WP-Recall – Registration, Profile, Commerce & More, 622793af3b328d977b3f5341e896f387c0fdbb66

CVE, Research URL: 622793af3b328d977b3f5341e896f387c0fdbb66
Home page URL: Security reports for WP-Recall – Registration, Profile, Commerce & More
Application: WP-Recall – Registration, Profile, Commerce & More
Published on: Oct 05, 2021
Research Description: WP-Recall – Registration, Profile, Commerce & More [wp-recall] < 16.24.48 (closed) WP-Recall <= 16.24.47 - Reflected Cross-Site Scripting The WP-Recall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date-start' and 'end-start' parameters in versions up to, and including, 16.24.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: Min -, max 16.24.48.
Status: vulnerable

WP-Recall &#8211; Registration, Profile, Commerce &amp; More, 622793af3b328d977b3f5341e896f387c0fdbb66