Reflected Cross-Site Scripting Vulnerability in Accept Donations with PayPal & Stripe Plugin for WordPress
CVE-2024-13728

6.1MEDIUM

Key Information:

Vendor
Scottpaterson
Status
Accept Donations With Paypal & Stripe
Vendor
CVE Published:
23 February 2025

Summary

The Accept Donations with PayPal & Stripe plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to inadequate input sanitization and output escaping. This issue affects all versions up to 1.4.4 and allows unauthenticated attackers to inject arbitrary scripts. Successful exploitation occurs when a user is deceived into clicking a malicious link, resulting in the execution of harmful scripts within their browser context. This can lead to session hijacking and other malicious activities, posing significant risks to users and their sensitive data.

Affected Version(s)

Accept Donations with PayPal & Stripe * <= 1.4.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/easy-paypal-do...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Luciano Hanna
.