Accessibility Help Button Vulnerabilities

[en] The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Jul 10, 2023

CVE-2023-2635 on NVD →

[en] The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

Jul 10, 2023

CVE-2023-2028 on NVD →

The Call Now Accessibility Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via "Button Text" in versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inje...

CVSS:

4.4

Affected:

up to 1.0.2

Fixed in:

1.1

Disclosed:

Jun 19, 2023

CVE-2023-2635 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <= 1.1 versions.

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

Jun 12, 2023

CVE-2023-28933 on NVD →

The Call Now Accessibility Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to injec...

CVSS:

4.4

Affected:

up to 1.1

Fixed in:

1.2

Disclosed:

Jun 2, 2023

CVE-2023-28933 on NVD →

The Call Now Accessibility Button for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...

Affected:

up to 1.1

Fix:

No patched version reported