Best Payments Plugin for WP < 4.2.1 – Unauthenticated Stored Cross-Site Scripting | CVE 2022-2565 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins

Proof of Concept

As unauthenticated, on a page/post where there is a contact form created via the plugin, put the following payload in the Name, Subject and Message fields: <img src onerror=alert(/XSS/)>

The XSS will be triggered when an admin will view the related entry

Affects Plugins

wp-payment-form

Fixed in 4.2.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Rafshanzani Suhada

Submitter

Rafshanzani Suhada

Verified

Yes

WPVDB ID

d89eff7d-a3e6-4876-aa0e-6d17e206af83

Timeline

Publicly Published

2022-08-10 (about 3 years ago)

Added

2022-08-10 (about 3 years ago)

Last Updated

2023-05-07 (about 2 years ago)

Other

Published

Title

Published

2015-08-26

Title

Navis DocumentCloud 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Published

2024-11-19

Title

404 Solution < 2.35.20 - Reflected Cross-Site Scripting

Published

2025-04-09

Title

WP Hide Categories <= 1.0 - Reflected Cross-Site Scripting

Published

2025-02-20

Title

WoWPth <= 2.0 - Reflected XSS

Published

2014-08-01

Title

Codilight Premium 1.0.0 - admin/front-end/options.php reset Parameter XSS