CVE-2022-36796

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at WordPress.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-352

Affected software

Vendor	Product	Versions
CallRail, Inc.	CallRail Phone Call Tracking (WordPress plugin)	>= <= 0.4.9, <= 0.4.9

References

https://patchstack.com/database/vulnerability/callrail-phone-call-tracking/wordpress-callrail-phone-call-tracking-plugin-0-4-9-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xssThird Party Advisory
https://wordpress.org/plugins/callrail-phone-call-tracking/Product, Third Party Advisory
https://patchstack.com/database/vulnerability/callrail-phone-call-tracking/wordpress-callrail-phone-call-tracking-plugin-0-4-9-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xssThird Party Advisory
https://wordpress.org/plugins/callrail-phone-call-tracking/Product, Third Party Advisory

Timeline

Published: Sep 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-367975.5Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenti CVE-2022-367988.8Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.CVE-2022-367997.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Af CVE-2022-368004.3Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission t CVE-2022-368016.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref CVE-2022-368024.9The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access interna CVE-2022-368038.8The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissi CVE-2022-368048.8Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,CVE-2022-36816.5A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless netwo CVE-2022-36828.8A vulnerability exists in the SDM600 file permission validation. An attacker could exploit the vulnerability by gaining access to the syste CVE-2022-368295.5PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files with CVE-2022-36837.5A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vu