WordPress Plugin Vulnerabilities

WP Full Stripe Free < 7.0.6 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Affects Plugins

Plugin icon
wp-full-stripe-free
Fixed in 7.0.6

References

CVE
CVE-2023-28934
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-full-stripe-free/wp-full-stripe-free-161-authenticated-administrator-stored-cross-site-scripting

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
easyBug
Verified
Yes
WPVDB ID
77bde578-56c7-4ed3-aa4f-e0148b52531a

Timeline

Publicly Published
2023-07-05 (about 2 years ago)
Added
2023-08-09 (about 2 years ago)
Last Updated
2024-03-12 (about 2 years ago)

Other

Published
Title
Published
2014-04-25
Title
Shortcode Ninja <= 1.4 - Unauthenticated Reflected XSS
Published
2016-03-11
Title
DW Question & Answer <= 1.4.2.2 - Stored Cross-Site Scripting (XSS)
Published
2026-02-06
Title
Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2026-04-21
Title
Private WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting
Published
2023-07-25
Title
Ninja Forms < 3.6.26 - Reflected Cross-Site Scripting