CVE-2023-2406

The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcitaExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55Exploit
• https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.phpExploit
• https://plugins.trac.wordpress.org/changeset/2924423/paypal-payment-button-by-vcita
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924420%40event-registration-calendar-by-vcita&new=2924420%40event-registration-calendar-by-vcita&sfp_email=&sfph_mail=
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924423%40paypal-payment-button-by-vcita&new=2924423%40paypal-payment-button-by-vcita&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab05954-9999-43ff-8e3c-a987e2da1956?source=cveBroken Link
• https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcitaExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55Exploit
• https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.phpExploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab05954-9999-43ff-8e3c-a987e2da1956?source=cveBroken Link

Published

Jun 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24054Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-24055KeePass through 2.53 (in a default installation) allows an a…5.5
• CVE-2023-24056In pkgconf through 1.9.3, variable duplication can cause unb…5.5
• CVE-2023-24057HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow…8.1
• CVE-2023-24058Booked Scheduler 2.5.5 allows authenticated users to create …4.3
• CVE-2023-24059Grand Theft Auto V for PC allows attackers to achieve partia…7.3
• CVE-2023-24060Haven 5d15944 allows Server-Side Request Forgery (SSRF) via …5
• CVE-2023-24062Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24063Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24064Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24065NOSH 4a5cfdb allows stored XSS via the create user page. For…5.4
• CVE-2023-24068Signal Desktop before 6.2.0 on Windows, Linux, and macOS all…7.8