Cross-site Scripting Vulnerability in Online Payments Plugin by vcita
CVE-2025-22661
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 January 2025
What is CVE-2025-22661?
The Online Payments plugin developed by vcita contains a vulnerability that allows for improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS) attacks. This security flaw affects versions from n/a through 3.20.0. If exploited, an attacker can inject malicious scripts into web pages viewed by other users, potentially compromising their data and privacy. It is essential for users to update to secure versions and follow best practices in application security to mitigate the risks associated with this type of vulnerability.
Affected Version(s)
Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0