PayPal: Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/

An endpoint used for currency conversion was found to suffer from a reflected XSS vulnerability, where user input was not being properly sanitized in a parameter in the URL. This could lead to a malicious user injecting malicious JavaScript, HTML, or any other type of code that the browser may...

Active PayPal Phishing Scam Targets SSNs, Passport Photos

A recently uncovered phishing campaign, targeting PayPal users, pulls out all the stops and asks victims for the complete spectrum of personal data – even going so far as to ask for social security numbers and uploaded photos of their passports. The campaign starts with a fairly run-of-the-mill...

16Shop Phishing Gang Goes After PayPal Users

A prolific phishing gang known as 16Shop has added PayPal customers to its target set. According to researchers at the ZeroFOX Alpha Team, the latest version of the group’s phishing kit is designed with a number of features that are aimed to steal as much personally identifiable information PII a...

Amazon Takes a Swipe at PayPal's $4 Billion Acquisition

The retail giant warned holiday shoppers that Honey, a popular browser extension, was a “security risk.” Honey denies the claim...

PayPal: Reflected XSS at https://www.paypal.com/ppcreditapply/da/us

Researchers identified endpoints that were vulnerable to reflected XSS, due to insufficient input sanitization. This could allow malicious client-side content to be rendered by the app, which could affect a user's session, browser, or the contents of the page itself. The issue was resolved by...

Magecart Group Switches Up Tactics with MiTM, Phishing

A fresh splinter group under the Magecart umbrella has been discovered ramping up activity starting in August-September of 2019. It’s using a unique codebase and different tactics to carry out its attacks, according to researchers. Magecart is an umbrella term encompassing several different threa...

PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...

CVE-2016-11008

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...

CVE-2019-5992

Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5992

Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5992

The CVE-2019-5992 entry concerns the WordPress plugin WordPress Ultra Simple Paypal Shopping Cart (versions 4.4 and earlier). The vulnerability is Cross-Site Request Forgery (CSRF) that can allow an attacker to hijack an administrator’s authenticated actions via unspecified vectors. Documented im...

CVE-2019-5992

Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...

Code injection

DISPUTED cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true tha...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...

CVE-2019-14979

The CVE-2019-14979 entry concerns the WooCommerce PayPal Checkout Payment Gateway plugin for WordPress (version 1.6.17). The vulnerability is described as parameter tampering in the PayPal flow via the cgi-bin/webscr?cmd=_cart endpoint, where the amount parameter (e.g., amount_1) can be manipulat...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...

WordPress WooCommerce PayPal Checkout Payment Gateway Plugin Input Validation Error Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WooCommerce PayPal Checkout Payment Gateway is a PayPal payment gateway plugin that is used in... WordPress WooCommerce PayPal Checkout...