Lucene search

K
wpvulndbWpvulndbWPVDB-ID:636FB2AC-A19A-4834-9718-F1965FEDBE09
HistoryJan 12, 2024 - 12:00 a.m.

Laybuy Payment Extension for WooCommerce <= 5.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

2024-01-1200:00:00
wpscan.com
5
laybuy
woocommerce
stored xss
input sanitization
output escaping
authenticated
contributor

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

Description The Laybuy Payment Extension for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

Related for WPVDB-ID:636FB2AC-A19A-4834-9718-F1965FEDBE09