The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Widget4Call WordPress plugin References: https://wpscan.com/vulnerability/a0cabf5c-7b01-4163-834b-a134db3a90b4/ Remediation: Update to the latest version of Widget4Call plugin that addresses this issue.
10 assets checked · domain, subdomain, ipv4
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →