Lucene search
Pablo SanchezWPVDB-ID:13F59EB4-0744-4FDB-94B5-886EE6BDD867HistoryMay 01, 2023 - 12:00 a.m.
WP EasyPay < 4.1 - Reflected Cross-Site Scripting
2023-05-0100:00:00
Pablo Sanchez
wpscan.com
6
wp easypay
cross-site scripting
vulnerability
admin
poc
0.0005 Low
EPSS
Percentile
17.1%
The plugin does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
PoC
When there is no account connected, make a logged in admin open https://example.com/wp-admin/edit.php?post_type=wp_easy_pay&page;=wpep-settings&a;">
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-easy-pay | lt | 4.1 |
Related
nvd
nvd
CVE-2023-1465
2023-08-16 12:15:12
cve
cve
CVE-2023-1465
2023-08-16 12:15:12
prion
prion
Cross site scripting
2023-08-16 12:15:00
wpexploit
wpexploit
WP EasyPay < 4.1 - Reflected Cross-Site Scripting
2023-05-01 00:00:00
cvelist
cvelist
CVE-2023-1465 WP EasyPay < 4.1 - Reflected Cross-Site Scripting
2023-08-16 11:03:27
wordfence
wordfence