Cross-Site Scripting in Payment Form for PayPal Pro Plugin by WordPress
CVE-2015-7666

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Payment Form For Paypal Pro
Vendor
CVE Published:
27 December 2017

What is CVE-2015-7666?

The Payment Form for PayPal Pro plugin for WordPress contains multiple cross-site scripting vulnerabilities in its cp_updateMessageItem and cp_deleteMessageItem functions. These vulnerabilities allow remote attackers to inject arbitrary web scripts or HTML through the manipulative cal parameter, posing significant security risks to affected WordPress installations. It is crucial for users to update to the latest version to mitigate these vulnerabilities and enhance site security.

References

https://wordpress.org/plugins/payment-form-for-paypal-pro...
x_refsource_CONFIRM
https://wpvulndb.com/vulnerabilities/8210
x_refsource_MISC
http://www.securityfocus.com/archive/1/536602/100/0/threaded
mailing-listx_refsource_BUGTRAQ

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.