Razorpay Payment Button Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-10851

Summary

The Razorpay Payment Button Plugin for WordPress is prone to a Reflected Cross-Site Scripting flaw due to improper handling of user input through the add_query_arg and remove_query_arg functions. This vulnerability allows unauthenticated attackers to craft malicious URLs that, when visited by an unsuspecting user, execute arbitrary web scripts on the affected website. As a result, an attacker can manipulate user actions by embedding malicious scripts in page links, potentially leading to unauthorized access and data theft.

References