Lucene search
WPScanCVELIST:CVE-2024-7861HistorySep 12, 2024 - 6:00 a.m.
CVE-2024-7861 Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF
2024-09-1206:00:06
WPScan
www.cve.org
3
cve-2024-7861
misiek paypal
stored xss
csrf
wordpress plugin
csrf vulnerability
sanitisation
escaping
admin account
EPSS
0.001
Percentile
17.7%
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Misiek Paypal",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "1.1.20090324"
}
],
"defaultStatus": "affected"
}
]Related
nvd
nvd
CVE-2024-7861
2024-09-12 06:15:24
vulnrichment
vulnrichment
CVE-2024-7861 Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF
2024-09-12 06:00:06
cve
cve
CVE-2024-7861
2024-09-12 06:15:24
wordfence
wordfence