PayPal Notifies 35,000 Users of Data Breach

By Habiba Rashid According to PayPal, hackers managed to access the personal information of 34,942 users; however, no transactions were performed from the breached accounts. This is a post from HackRead.com Read the original post: PayPal Notifies 35,000 Users of Data Breach...

Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks wpecpp name="' accesskey='X' onclick='alert1...

WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nice PayPal Button Lite Type Plugin Vulnerable versions = 1.3.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22686 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 497c643d4eec Credits Mika Required...

Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC wpecpp name="' accesskey='X'...

Nice PayPal Button Lite <= 1.3.5 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

WordPress Easy PayPal Buy Now Button Plugin < 1.7.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy PayPal Buy Now Button Type Plugin Vulnerable versions 1.7.3 Fixed in 1.7.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d96c1118d3fb Credits WPScanTeam Required...

WordPress Easy PayPal Buy Now Button Plugin <= 1.7.3 is vulnerable to Cross Site Scripting (XSS)

Software Easy PayPal Buy Now Button Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.7.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4628 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 5be7732f69eb Credits István...

Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. wppaypalpaymentboxforanyamount...

Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC wppaypalpaymentboxforanyamount...

CVE-2022-3983

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-3983

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-3983 Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-3983 Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

WordPress plugin Checkout for PayPal 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2022-25020 · WordPress · Checkout For Paypal

Name of the Vulnerable Software and Affected Versions: The Checkout for PayPal WordPress plugin versions prior to 1.0.14 Description: The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in the page. This could allow users wit...

A week in security (December 5 - 11)

Last week on Malwarebytes Labs: Security advisories are falling short. Here's why, with Dustin Childs: Lock and Code S03E25 Eufy "no cloud" security cameras streaming data to the cloud Snapchat gives Californians more power over their personal data Update now! Emergency fix for Google Chrome's V8...

Watch out for this triple threat PayPal phish

ZDNet reports an interesting form of PayPal scam sent to one of their own writers. The scam is a so-called "triple threat" phish, in that it gives the scammer three different ways to potentially collect some ill gotten gains from potential victims. The idea is that if one of the three tactics...

CAPTCHA

This is an actual CAPTCHA I was shown when trying to log into PayPal. As an actual human and not a bot, I had no idea how to answer. Is this a joke? Seems not. Is it a Magritte-like existential question? Its not a bicycle. Its a drawing of a bicycle. Actually, its a photograph of a drawing of a...

WordPress Donations via PayPal plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Donations via PayPal plugin version 1.9.9 has a cross-site scripting vulnerability that ste...