CVE-2024-10851: Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10851?
CVE-2024-10851 has a medium severity due to its ability to allow reflected cross-site scripting, which can compromise user data.
How do I fix CVE-2024-10851?
To fix CVE-2024-10851, update the Razorpay Payment Button Plugin to version 2.4.7 or later.
Who is affected by CVE-2024-10851?
All users of the Razorpay Payment Button Plugin for WordPress versions up to and including 2.4.6 are affected by CVE-2024-10851.
What kind of attack does CVE-2024-10851 enable?
CVE-2024-10851 enables reflected cross-site scripting attacks that can be exploited by unauthenticated users.
When was CVE-2024-10851 disclosed?
CVE-2024-10851 was disclosed in 2024, highlighting a critical vulnerability in the Razorpay Payment Button Plugin.