WordPress Plugin Vulnerabilities

Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins

Proof of Concept

As unauthenticated, on a page/post where there is a contact form created via the plugin, put the following payload in the Name, Subject and Message fields: <img src onerror=alert(/XSS/)>

The XSS will be triggered when an admin will view the related entry

Affects Plugins

Plugin icon
wp-payment-form
Fixed in 4.2.1

References

CVE
CVE-2022-2565

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Submitter
Rafshanzani Suhada
Verified
Yes
WPVDB ID
d89eff7d-a3e6-4876-aa0e-6d17e206af83

Timeline

Publicly Published
2022-08-10 (about 1 years ago)
Added
2022-08-10 (about 1 years ago)
Last Updated
2023-05-07 (about 6 months ago)

Other

Published
Title
Published
2022-09-27
Title
Forym <= 1.5.8 - Reflected Cross-Site Scripting
Published
2021-07-29
Title
FluentSMTP < 2.0.1 - Authenticated Stored XSS
Published
2023-10-02
Title
Email posts to subscribers <= 6.2 - Admin+ Stored XSS
Published
2023-02-01
Title
Donation Block For PayPal < 2.1.0 - Contributor+ Stored XSS
Published
2021-11-16
Title
Mortgage Calculator / Loan Calculator < 1.5.17 - Contributor+ Stored Cross-Site Scripting