QwikSec

Security Database

CVE

CWE

Training

CVE-2023-2301

Published: Jun 3, 2023

Modified: Apr 8, 2026

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While the Cross-Site Scripting issue was patched in version 4.10.1, the plugin is still technically vulnerable to Cross-Site Request Forgery since a capability check but no nonce check was added in 4.10.2.

Vendor	Product	Versions
eyale-vc	Contact Form Builder by vcita	affected `0 - <= 4.10.3`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/61c39f5f-3b17-4e4d-824e-241159a73400?source=cve

https://plugins.trac.wordpress.org/browser/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php#L55

https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita

https://plugins.trac.wordpress.org/changeset/3200766/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

CVE-2023-2301 | MEDIUM (6.1) - Security Vulnerability | QwikSec