Razorpay Payment Button Plugin Vulnerable to Reflected Cross-Site Scripting
CVE-2024-10851

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Razorpay Payment Button
Vendor
CVE Published:
13 November 2024

What is CVE-2024-10851?

The Razorpay Payment Button Plugin for WordPress is prone to a Reflected Cross-Site Scripting flaw due to improper handling of user input through the add_query_arg and remove_query_arg functions. This vulnerability allows unauthenticated attackers to craft malicious URLs that, when visited by an unsuspecting user, execute arbitrary web scripts on the affected website. As a result, an attacker can manipulate user actions by embedding malicious scripts in page links, potentially leading to unauthorized access and data theft.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/razorpay-payme...
https://plugins.trac.wordpress.org/browser/razorpay-payme...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.