Reflected Cross-Site Scripting Vulnerability in PayGreen Payment Gateway for WordPress

CVE-2024-11810

What is CVE-2024-11810?

The PayGreen Payment Gateway plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit reflected cross-site scripting via the 'message_id' parameter. This issue stems from inadequate input sanitization and output escaping, enabling attackers to inject malicious scripts into web pages. If users are tricked into clicking a compromised link, the malicious scripts can execute in their browsers, potentially leading to data theft or session hijacking.

References