Easy PayPal & Stripe Buy Now Button, 4127b76c-4e4b-483b-8905-b5ca6d24337d
- CVE, Research URL
- Application
- Published on
- -
- Research Description
- Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal] < 1.7.3 Easy PayPal Buy Now Button < 1.7.3 - CSRF to Stored Cross-Site Scripting The plugin does not have CSRF check in place when saving its settings, and does not sanitise as well as escape them when output in the page. As a result, an attacker could make a logged in admin change them via. CSRF attack and perform Cross-Site Scripting attacks. The plugin also fixed a Reflected XSS in web browsers which do not encode URL characters
- Affected versions
-
max 1.7.3.
- Status
-
vulnerable