Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
243 results · page 4 of 5
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request Forgery (CSRF)CVE-2023-51683 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
- Product
- Easy PayPal & Stripe Buy Now Button
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request ForgeryCVE-2024-1719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Easy PayPal & Stripe Buy Now Button
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.CVE-2023-24405 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.
- Fixed in
- 1.9.4
- What to do
- Update the plugin to 1.9.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.CVE-2023-35917 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 3, 2023The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WoCVE-2023-2407 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the ls_parse_vcita_callback() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Jun 3, 2023The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WorCVE-2023-2406 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
May 2, 2023Quick Paypal Payments: Does not sanitise and escape some of its settingsCVE-2023-1554 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quick Paypal Payments
- Fixed in
- 5.7.26.4
- What to do
- Update Quick Paypal Payments to 5.7.26.4 or newer.
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.CVE-2023-22686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 31, 2023PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support.CVE-2023-28843 · Other software · 202ecommerce · reported by GitHubCritical 9.8
PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.
- Product
- paypal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Donation Block For PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0535 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Donation Block For PayPal
- Fixed in
- 2.1.0
- What to do
- Update Donation Block For PayPal to 2.1.0 or newer.
Feb 24, 2023sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.CVE-2022-48345 · Other software · Paypal · reported by MITREMedium 6.1
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
- Product
- Braintree/sanitize-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Easy Accept Payments for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0275 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Accept Payments for PayPal
- Fixed in
- 4.9.10
- What to do
- Update Easy Accept Payments for PayPal to 4.9.10 or newer.
Feb 13, 2023Easy PayPal Buy Now Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4628 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy PayPal Buy Now Button
- Fixed in
- 1.7.4
- What to do
- Update Easy PayPal Buy Now Button to 1.7.4 or newer.
Feb 3, 2023SwagPayPal is a PayPal integration for shopware/platform.CVE-2023-23941 · Other software · shopware · reported by GitHubHigh 7.5
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
- Product
- SwagPayPal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.CVE-2022-21129 · Other software · Paypal · reported by report@snyk.ioHigh 7.4
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.
- Product
- Nemo-appium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022Checkout for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3983 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Checkout for PayPal
- Fixed in
- 1.0.14
- What to do
- Update Checkout for PayPal to 1.0.14 or newer.
Nov 28, 2022Donations via PayPal: Does not sanitise and escape some of its settingsCVE-2022-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Donations via PayPal
- Fixed in
- 1.9.9
- What to do
- Update Donations via PayPal to 1.9.9 or newer.
May 2, 2022LifterLMS PayPal: Does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the pageCVE-2022-1250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- LifterLMS PayPal
- Fixed in
- 1.4.0
- What to do
- Update LifterLMS PayPal to 1.4.0 or newer.
Full record and what to do →NVD recordmake.lifterlms.comwpscan.com
Mar 16, 2022The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.CVE-2021-23648 · Other software · Paypal · reported by report@snyk.ioMedium 5.4
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
- Product
- Braintree/sanitize-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.4
- What to do
- Update Accept Donations with PayPal to 1.3.4 or newer.
Dec 7, 2021Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, thatCVE-2021-40578 · Other software · Online Enrollment Management System Project · reported by MITREHigh 7.2
Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, that allows attackers to obtain sensitive information and execute arbitrary SQL commands via IDNO parameter.
- Product
- Online Enrollment Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Accept Donations with PayPal: Does not escape the Amount Menu Name field of created ButtonsCVE-2021-24815 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.2
- What to do
- Update Accept Donations with PayPal to 1.3.2 or newer.
Nov 1, 2021Accept Donations with PayPal: Provides a function to create donation buttonsCVE-2021-24572 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.1
- What to do
- Update Accept Donations with PayPal to 1.3.1 or newer.
Nov 1, 2021Accept Donations with PayPal: Offers a function to create donation buttonsCVE-2021-24570 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.1
- What to do
- Update Accept Donations with PayPal to 1.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 5, 2021sylius/paypal-plugin is a paypal plugin for the Sylius development platform.CVE-2021-41120 · Other software · Sylius · reported by GitHubHigh 7.5
sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled "credit card holder" field with the Customer's first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: ['SCA_ALWAYS'] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function ca
- Product
- PayPalPlugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before insCVE-2021-24390 · WordPress plugins & themes · reported by WPScanHigh 7.2
A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.
- Product
- WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021Bookshelf: Does not sanitise or escape its "Paypal email address" setting before outputting it in the pageCVE-2021-24478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Bookshelf
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Bookshelf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2020The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.CVE-2020-14092 · WordPress plugins & themes · reported by MITRECritical 9.8
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
- Product
- CodePeople Payment Form for PayPal Pro
- Fixed in
- 1.1.65
- What to do
- Update CodePeople Payment Form for PayPal Pro to 1.1.65 or newer.
Full record and what to do →NVD recordwordpress.dwbooster.comwordpress.org
Apr 23, 2020paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution.CVE-2020-7643 · Other software · Idea · reported by report@snyk.ioMedium 5.3
paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
- Product
- Paypal-adaptive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such CVE-2019-14979 · WordPress plugins & themes · reported by MITREMedium 5.3
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
- Product
- WooCommerce PayPal Checkout Payment Gateway
- Affected
- 1.6.17 to 1.6.17
- What to do
- Affects 1.6.17 to 1.6.17. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgkaim.comwordpress.org
Aug 28, 2019PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9373 · WordPress plugins & themes · reported by MITREMedium 6.1
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- Product
- PayPal Pro Add-on for iThemes Exchange
- Fixed in
- 1.1.0
- What to do
- Update PayPal Pro Add-on for iThemes Exchange to 1.1.0 or newer.
Full record and what to do →NVD recordblog.sucuri.netithemes.com
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
- Product
- CP Contact Form with PayPal
- Fixed in
- 1.2.98
- What to do
- Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 9, 2019The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.phpCVE-2019-14785 · WordPress plugins & themes · reported by MITREMedium 5.4
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
- Product
- CP Contact Form with PayPal
- Fixed in
- 1.2.99
- What to do
- Update CP Contact Form with PayPal to 1.2.99 or newer.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Jul 10, 2019paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code executionCVE-2017-6217 · Other software · Paypal · reported by MITREMedium 6.1
paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution
- Product
- Adaptive Payments SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such aCVE-2019-7441 · WordPress plugins & themes · reported by MITREMedium 6.5
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
- Product
- WooCommerce PayPal Checkout Payment Gateway
- Affected
- 1.6.8 to 1.6.8
- What to do
- Affects 1.6.8 to 1.6.8. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgkaim.com
Aug 2, 2018paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.CVE-2017-6215 · Other software · Paypal · reported by MITREMedium 5.4
paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.
- Product
- PHP Permissions SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2018paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.CVE-2017-6213 · Other software · Paypal · reported by MITREMedium 5.4
paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.
- Product
- PHP Invoice SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2018paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or theCVE-2014-10067 · Other software · HackerOne · reported by support@hackerone.comMedium 5.9
paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.
- Product
- paypal-ipn node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Apr 27, 2018The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.CVE-2013-7202 · Other software · Paypal · reported by MITREHigh 8.1
The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.
- Product
- Paypal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comlabs.mwrinfosecurity.com
Apr 27, 2018WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive inCVE-2013-7201 · Other software · Paypal · reported by MITREHigh 7.4
WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
- Product
- Paypal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexchange.xforce.ibmcloud.com
Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cCVE-2015-9234 · WordPress plugins & themes · reported by MITREHigh 7.2
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
- Product
- cp-contact-form-with-paypal (aka CP Contact Form with PayPal)
- Fixed in
- 1.1.6
- What to do
- Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 29, 2017The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.phpCVE-2015-9233 · WordPress plugins & themes · reported by MITREHigh 8.8
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
- Product
- cp-contact-form-with-paypal (aka CP Contact Form with PayPal)
- Fixed in
- 1.1.6
- What to do
- Update cp-contact-form-with-paypal (aka CP Contact Form with PayPal) to 1.1.6 or newer.
Full record and what to do →NVD recordseclists.orgseclists.org
Feb 23, 2017Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arCVE-2017-6099 · Other software · Paypal · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
- Product
- Merchant-sdk-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 24, 2015Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WoCVE-2015-5065 · WordPress plugins & themes · reported by MITREMedium 5
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
- Fixed in
- 1.4
- What to do
- Update the plugin to 1.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plugin 4.7 and earlier fCVE-2014-4552 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plugin 4.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the paymentType parameter.
- Product
- Spotlight (spotlightyour)
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update Spotlight (spotlightyour) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
May 13, 2014Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack tCVE-2013-2705 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings.
- Product
- Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart
- Fixed in
- 3.6
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart to 3.6 or newer.
Feb 24, 2013CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's eCVE-2013-0118 · Other software · Cs-cart · reported by cret@cert.orgMedium 5
CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
- Product
- Cs-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.