Easy PayPal Shopping Cart, d9c154a32db8150cd5b35b089c8962452eb8b232

CVE, Research URL: d9c154a32db8150cd5b35b089c8962452eb8b232
Home page URL: Security reports for Easy PayPal Shopping Cart
Application: Easy PayPal Shopping Cart
Published on: Nov 03, 2023
Research Description: Easy PayPal Shopping Cart [easy-paypal-shopping-cart] < 1.1.11 Easy PayPal Shopping Cart <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode The Easy PayPal Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level and above permissions, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.1.11.
Status: vulnerable