Woocommerce Extra Charges To Payment Gateways Vulnerabilities

The Extra Charges To Payment Gateway For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the add_form_fields() method, hooked to the admin_head action in versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauth...

CVSS:

6.4

Affected:

up to 2.0.2.1

Fix:

No patched version reported

Disclosed:

Feb 8, 2021

The Extra Charges To Payment Gateway For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the add_form_fields() method, hooked to the admin_head action in versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauth...

Affected:

up to 2.0.2.1

Fix:

No patched version reported

Disclosed:

Feb 8, 2021

The add_form_fields() method, hooked to the admin_head action is lacking any CSRF and capability checks, allowing low privilege users to arbitrary update those settings, and set XSS payloads in them as well, which could lead to privilege escalation. Unauthenticated users could also make a logged in user change those se...

Affected:

up to 2.0.2.1

Fix:

No patched version reported