Stored Cross-Site Scripting in Online Payments Plugin for WordPress

CVE-2024-11895

What is CVE-2024-11895?

The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress exposes a vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes. This flaw allows authenticated attackers, granted contributor-level access or higher, to embed malicious web scripts through shortcodes on affected pages. When users access these compromised pages, the injected scripts execute, potentially leading to unauthorized actions or data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References