WordPress Plugin Vulnerabilities

PayU India <= 3.8.8 - Reflected XSS via type

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the ‘type’ parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
payu-india
No known fix

References

CVE
CVE-2024-27193
URL
https://patchstack.com/database/vulnerability/payu-india/wordpress-payu-india-plugin-3-8-2-reflected-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Dimas Maulana
Verified
No
WPVDB ID
68f99d3c-f2ed-4e7e-81b9-1af1409846f0

Timeline

Publicly Published
2024-02-26 (about 2 years ago)
Added
2024-02-28 (about 2 years ago)
Last Updated
2025-07-04 (about 10 months ago)

Other

Published
Title
Published
2024-03-07
Title
Premium Addons PRO < 2.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module
Published
2022-05-04
Title
Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting
Published
2024-04-25
Title
Virtue < 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Published
2014-08-01
Title
GroupDocs Signature 1.2.0 - options.php Multiple Parameter XSS
Published
2024-07-01
Title
SuperSaaS – online appointment scheduling < 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting