Cross-site Scripting Vulnerability in GoUrl Bitcoin Payment Gateway & Paid Downloads by GoUrl

CVE-2025-48102

What is CVE-2025-48102?

The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin is vulnerable to a Cross-site Scripting (XSS) attack due to improper handling of user input during web page generation. This flaw allows an attacker to inject malicious scripts, which are then stored and executed in the context of the affected application. Users accessing compromised pages may unknowingly execute harmful scripts, potentially leading to session hijacking, data theft, or other malicious actions. It is essential for users of versions from n/a through 1.6.6 to assess their exposure and implement necessary security measures.

References