CVE-2022-3983 Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

2022-12-1913:41:43

WPScan

www.cve.org

paypal

wordpress

stored xss

contributor role

EPSS

0.001

Percentile

25.1%

JSON

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Checkout for PayPal",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.0.14"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/0b48bbd6-7c77-44b8-a5d6-34e4a0747cf1

EPSS

0.001

Percentile

25.1%

JSON

Related for CVELIST:CVE-2022-3983