Easy PayPal Shopping Cart <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The Easy PayPal Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib...
- CVSS:
- 6.4
- Affected:
- up to 1.1.10
- Fixed in:
- 1.1.11
- Disclosed:
- Nov 3, 2023
CVE-2023-47239 on NVD →
Easy PayPal Shopping Cart <= 1.1.9 - Cross-Site Request Forgery to Cross-Site Scripting
high
The Easy PayPal Shopping Cart for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing nonce validation on the wpepsc_plugin_options function. This makes it possible for unauthenticated attackers to modify the plugins setting and add malicious web scripts...
- CVSS:
- 8.8
- Affected:
- up to 1.1.9
- Fixed in:
- 1.1.10
- Disclosed:
- May 25, 2022
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database