CVE-2023-5051 in CallRail Phone Call Tracking Plugin
Summary
by MITRE • 10/27/2023
The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'form_id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The CallRail Phone Call Tracking plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects versions up to and including 052. This vulnerability resides within the 'callrail_form' shortcode implementation where the 'form_id' attribute fails to undergo proper input sanitization and output escaping. The flaw allows authenticated attackers who possess contributor level permissions or higher to inject malicious web scripts into the plugin's shortcode functionality. The vulnerability operates as a stored XSS vector because the malicious code is persisted in the database and executed whenever users access pages containing the compromised shortcode. This creates a persistent threat that can affect any user who views pages where the malicious code has been injected through the vulnerable plugin.
The technical exploitation of this vulnerability follows a well-established pattern that aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation. Attackers with contributor privileges can leverage their access rights to modify content and insert malicious JavaScript payloads through the 'form_id' parameter. The vulnerability demonstrates a failure in proper input validation and output escaping mechanisms, which are fundamental security controls recommended by the OWASP Top Ten and the CWE database. When the shortcode processes the user-supplied 'form_id' attribute without adequate sanitization, it allows attackers to inject script tags or other malicious code that will execute in the context of other users' browsers.
The operational impact of this vulnerability extends beyond simple script execution as it creates a persistent backdoor for attackers to maintain access to compromised WordPress installations. The stored nature of the XSS means that malicious scripts will execute automatically whenever affected pages are loaded, potentially leading to session hijacking, credential theft, or further exploitation of the compromised environment. Attackers can use this vulnerability to escalate privileges, modify content, or redirect users to malicious sites. The impact is particularly concerning given that contributors typically have significant access rights within WordPress environments, including the ability to publish posts and pages, making this vulnerability a potential gateway for more serious attacks within the WordPress ecosystem.
Mitigation strategies for this vulnerability should include immediate patching of the CallRail plugin to version 053 or later, which addresses the input sanitization and output escaping deficiencies. Organizations should also implement strict input validation on all user-supplied parameters and enforce proper output escaping for all dynamic content. The principle of least privilege should be applied to restrict contributor-level access to plugin configuration options where possible. Security monitoring should be enhanced to detect unusual content modifications and script injections. Additionally, implementing content security policies can provide an additional layer of protection against XSS attacks by restricting script execution from untrusted sources. This vulnerability highlights the importance of input validation and output escaping as core security practices that align with both the ATT&CK framework's defense evasion techniques and industry security standards such as those outlined in the NIST Cybersecurity Framework.