CVE-2022-4628: Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode
Published Feb 13, 2023
·Updated
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Software
1 affected component
Wpplugin Easy Paypal Buy Now Button Wordpress<1.7.4
Event History
Feb 13, 2023
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the Easy PayPal Buy Now Button WordPress plugin?
The vulnerability ID for the Easy PayPal Buy Now Button WordPress plugin is CVE-2022-4628.
2
What is the severity of CVE-2022-4628?
CVE-2022-4628 has a severity rating of medium (5.4).
3
What is the affected software for CVE-2022-4628?
The affected software for CVE-2022-4628 is the Easy PayPal Buy Now Button WordPress plugin before version 1.7.4.
4
What is the CWE ID for CVE-2022-4628?
The CWE ID for CVE-2022-4628 is CWE-79.
5
How can the vulnerability be exploited?
CVE-2022-4628 can be exploited through Stored Cross-Site Scripting attacks by users with the contributor role and above.