Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-36796: CallRail Phone Call Tracking

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at WordPress.

CVE
#xss#csrf#vulnerability#web#js#git#java#wordpress
  • Details
  • Reviews
  • Installation
  • Support
  • Development

CallRail is here to bring complete visibility to the marketers who rely on quality inbound leads to measure success. Our customers live in a results-driven world, and giving them a clear view into their digital marketing efforts is a first priority for CallRail. We see the opportunities in surfacing and connecting data from calls, forms, chat and beyond — helping our customers get to better outcomes.

Our WordPress plugin allows you to learn detailed information about the source and web session of every caller from your website using a process called Dynamic Number Insertion. It also powers our form tracking tool, which gives you the power to attribute form submissions back to their source and learn about what the user did on your site before submitting the form.

  • Learn more about CallRail.
  • Check out our WP plugin support documentation.
  1. Sign in to your CallRail account and click the Settings tab.
  2. Select the company you want from the dropdown menu.
  3. Find the WordPress plugin in the list of integrations and click Instructions.
  4. Download the plugin and follow the instructions listed.

Full documentation can be found here.

Constant integration issues with Adwords make our conversion data mostly useless. In Adwords this is a huge problem. They recently lost 2/3 of our all time call recordings!!! This data was priceless and is unrecoverable. Callrail’s support is some of the worst I have encountered and even during emergency situations they are not in a hurry to help. Calls to support go unanswered and if we get a callback it is often the next day by someone who has little knowledge. We are finding a new company to work with and I would suggest others to do the same. I will update this post with a full breakdown of all our callrail issues once we have migrated to a new provider. Too many to list at the current moment 🙁

Read all 4 reviews

“CallRail Phone Call Tracking” is open source software. The following people have contributed to this plugin.

Contributors

  • apowellgt

0.2

  • Initial public release.

0.3

  • Update to version 2 of the javascript tracking script (swap.js)
  • Prompt the user to add an API key after installation.
  • Don’t insert the CallRail script if no API key is present.
  • Trim whitespace surrounding the API key before saving.

0.3.1

  • Update to version 3 of the javascript tracking script (swap.js)

0.3.2

  • Update to version 4 of the javascript tracking script (swap.js) which supports more advanced number replacement.

0.3.3

  • Update to version 5 of the javascript tracking script (swap.js)

0.3.4

  • Update to version 7 of the javascript tracking script (swap.js) and serve the script via the MaxCDN network (cdn.callrail.com).

0.3.5

  • Update to version 8 of the javascript tracking script (swap.js).

0.3.6

  • Update to version 10 of the javascript tracking script (swap.js).

0.3.7

  • Add a HTML comment so the CallRail support team can see when swap.js is installed via WordPress.

0.3.8

  • Update to version 11 of the javascript tracking script (swap.js).

0.3.11

  • Set Callrail cookies via HTTP using xhr request from swap.js script.

0.4.0

  • Added an optional feature to load required scripts as first-party through WordPress.

0.4.1

  • Various bug fixes.
  • Default first-party swap.js to on after testing if it is supported or not.

0.4.2

  • Fix bug where forms were not rendering for first-party enabled sites.

0.4.3

  • update the readme.

0.4.4

  • Change the default value for the “Enable As First Party Script” flag to false for initial Installations.

0.4.5

  • Add the newly required parameter “permission_callback” to all custom REST endpoint definitions

0.4.6

  • Updating tested up to version.

0.4.7

  • Updating tested up to version. redeploy.

0.4.8

  • Updating tested up to version. redeploy.

0.4.9

  • Fixed End User IP Address detection

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907