Stored Cross-Site Scripting Vulnerability in Payment Forms for Paystack Plugin

CVE-2024-10894

What is CVE-2024-10894?

The Payment Forms for Paystack plugin presents a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in its shortcode implementations, such as 'datepicker', 'textarea', and 'text'. Authenticated users with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, leading to the execution of malicious scripts when other users access the affected pages. This can compromise the integrity of the website and jeopardize user security.

References