CVE-2024-5448

🗓️ 21 Jun 2024 06:00:06Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

WordPress plugin Paypal Pay Now, Buy Now, Donation and Cart Buttons Shortcode does not validate and escape attributes, leading to XSS attack

Reporter	Title	Published	Views	Family All 13
CNNVD	WordPress plugin PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode security vulnerability	21 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-5448 PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Contributor+ Stored XSS	21 Jun 202406:00	–	cvelist
NVD	CVE-2024-5448	21 Jun 202406:15	–	nvd
osv_cve	CVE-2024-5448	21 Jun 202406:15	–	osv_cve
Patchstack	WordPress PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin <= 1.7 - Contributor+ Stored XSS vulnerability	21 Jun 202407:25	–	patchstack
Patchstack	WordPress PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)	21 Jun 202400:00	–	patchstack
Positive Technologies	PT-2024-36350 · WordPress · Paypal Pay Now	21 Jun 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-5448: Improper Neutralization of Input During Web Page Generation	21 Jun 202400:00	–	rapid7
RedhatCVE	CVE-2024-5448	23 May 202509:28	–	redhatcve
Vulnrichment	CVE-2024-5448 PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Contributor+ Stored XSS	21 Jun 202406:00	–	vulnrichment

NVD

Vulners

Node

mohsinrasool paypal_pay_now,_buy_now,_donation_and_cart_buttons_shortcodeRange≤1.7wordpress

[
  {
    "vendor": "Unknown",
    "product": "PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.7"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c482fe19-b643-41ea-8194-22776b388290/

Parameter	Position	Path	Description	CWE
type	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79
name	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79
amount	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79
quantity	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79
add_note	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79
quantity_txt_postfix	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79
field_sep	request body	/	Stored Cross-Site Scripting (XSS) via unvalidated and unescaped shortcode attributes in the [paypal_button] shortcode.	CWE-79

17 Jun 2026 08:15Current

6Medium risk

Vulners AI Score6

CVSS 3.15.4 - 6.1

EPSS0.00315

SSVC

CWE-79