Reflected Cross-Site Scripting Vulnerability in Pago por Redsys Plugin for WordPress
CVE-2024-12467

6.1MEDIUM

Key Information:

Vendor
Grafreak
Status
Pago Por Redsys
Vendor
CVE Published:
22 February 2025

Summary

The Pago por Redsys plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the 'Ds_MerchantParameters' parameter. This vulnerability arises from inadequate input sanitization and output escaping in all versions up to and including 1.0.12. Attackers can exploit this weakness to inject arbitrary web scripts into pages, executing the script if a user is deceived into clicking a specially crafted link. This could lead to unauthorized actions being performed in the context of a user's session, potentially compromising sensitive information.

Affected Version(s)

Pago por Redsys * <= 1.0.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/pago-redsys-tp...
https://plugins.trac.wordpress.org/browser/pago-redsys-tp...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

José Aguilera
.