CVE-2023-1469: mra13 wp express checkout (accept paypal payments easily) Cross-site Scripting

Vulnerability summary

CVE-2023-1469 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in mra13 wp express checkout (accept paypal payments easily). EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities.

Timeline

1. 17-03-2023
   PublishedVulnerability first disclosed.
2. 05-02-2025
   Last modifiedVulnerability information updated.

Description

The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.