WordPress Plugin Vulnerabilities

Best Payments Plugin for WP < 4.2.1 - Reflected Cross-Site Scripting

Description

The plugin does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
wp-payment-form
Fixed in 4.2.1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
9ff8a652-2340-476d-8430-70b203c023e1

Timeline

Publicly Published
2022-08-10 (about 3 years ago)
Added
2022-08-10 (about 3 years ago)
Last Updated
2022-08-10 (about 3 years ago)

Other

Published
Title
Published
2026-03-10
Title
WP ULike < 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
Published
2013-08-13
Title
Contact Form Plugin < 3.52 - XSS
Published
2024-09-03
Title
Popup Box < 4.7.8 - Admin+ Stored XSS
Published
2024-12-13
Title
Filestack Official < 3.0.0 - Reflected Cross-Site Scripting
Published
2025-03-27
Title
The Pack Elementor addons < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting