CVE-2025-12017

CVE-2025-12017 concerns the VNPAY Payment gateway plugin for WordPress. Based on Wordfence and PatchStack sources in connected documents, the vulnerability is a reflected cross-site scripting (Reflected XSS) via the message parameter, affecting all versions up to and including 1.0.0. The root cau...

CVE-2025-12017: Improper Neutralization of Input During Web Page Generation

The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

WordPress VNPAY for Woocommerce plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin VNPAY Payment gateway versions = 1.0.0...