WordPress Plugin Vulnerabilities

Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site Scripting

Description

The plugin does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
woo-altcoin-payment-gateway
Fixed in 1.6.1

References

CVE
CVE-2021-24679

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
7c6c0aac-1733-4abc-8e95-05416636a127

Timeline

Publicly Published
2021-09-06 (about 4 years ago)
Added
2021-09-06 (about 4 years ago)
Last Updated
2023-01-29 (about 2 years ago)

Other

Published
Title
Published
2024-06-20
Title
Sinatra <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-07-24
Title
Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS
Published
2025-01-07
Title
Easy Form Builder < 3.8.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2024-11-29
Title
GTPayment Donations <= 1.0.0 - Stored XSS via CSRF
Published
2024-03-11
Title
Beaver Builder < 2.7.4.5 - Contributor+ Stored Cross-Site Scripting via heading tag