CVE-2024-7861: Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7861?
CVE-2024-7861 is classified as a medium severity vulnerability due to the potential for stored XSS attacks.
How do I fix CVE-2024-7861?
To mitigate CVE-2024-7861, update the Misiek Paypal WordPress plugin to a version later than 1.1.20090324.
What type of attack is associated with CVE-2024-7861?
CVE-2024-7861 is associated with Cross-Site Request Forgery (CSRF) attacks that could lead to Stored XSS.
Which versions of Misiek Paypal are affected by CVE-2024-7861?
CVE-2024-7861 affects Misiek Paypal WordPress plugin versions up to and including 1.1.20090324.
Is there a known exploit for CVE-2024-7861?
As of now, there is no public knowledge of an active exploit specifically targeting CVE-2024-7861.