UCRM Client Signup Plugin Cross-Site Request Forgery Leading to Cross-Site Scripting Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the UCRM Client Signup Plugin versions through 1.3.4. This vulnerability can lead to Cross-Site Scripting (XSS) and potential privilege escalation if an Administrator is deceived into visiting a maliciously crafted page. It is important to note that the plugin is disabled by default.

Impact

Exploitation of this vulnerability could result in Cross-Site Scripting, allowing an attacker to inject malicious scripts that could be executed in the context of the user's browser.