CVE-2024-5447: PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Admin+ Stored XSS
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5447?
CVE-2024-5447 has a high severity rating due to the potential for stored cross-site scripting attacks by high privilege users.
How do I fix CVE-2024-5447?
To fix CVE-2024-5447, update the PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin to version 1.8 or above where the issue is addressed.
Who is affected by CVE-2024-5447?
CVE-2024-5447 affects WordPress installations using the PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin versions up to 1.7.
What type of vulnerability is CVE-2024-5447?
CVE-2024-5447 is classified as a stored cross-site scripting (XSS) vulnerability.
Can unprivileged users exploit CVE-2024-5447?
No, CVE-2024-5447 can only be exploited by high privilege users, such as administrators, who can bypass input validation.