Reflected Cross-Site Scripting Vulnerability in Razorpay Subscription Button for WordPress
CVE-2024-13827
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 March 2025
What is CVE-2024-13827?
The Razorpay Subscription Button Elementor Plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts. This is caused by the improper use of add_query_arg() and remove_query_arg() functions, which do not properly escape URLs. Attackers can exploit this vulnerability by tricking users into clicking on malicious links, leading to unauthorized script executions within legitimate website pages.
Affected Version(s)
Razorpay Subscription Button Elementor Plugin * <= 1.0.3