WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting

Vulnerability

The myghpay WooCommerce Payment Gateway plugin for WordPress, versions up to and including 3.0, contains a reflected Cross-Site Scripting (XSS) vulnerability in the clientref parameter found in the ~/processresponse.php file [1]. The parameter is echoed back without proper sanitization or encoding, allowing an attacker to inject arbitrary HTML and JavaScript. The plugin has been removed from the WordPress.org directory due to this security issue [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a clientref parameter with embedded JavaScript payload. The victim must be logged in to the WordPress admin area and click the crafted link. No authentication is required to trigger the reflection, though the impact is limited to the victim's session context. The plugin closure suggests no patch exists, making exploitation straightforward as long as the plugin remains installed.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's WordPress admin session. This can lead to session hijacking, credential theft, or forced administrative actions. The scope of the attack is limited to reflected XSS, requiring user interaction, but can still compromise the site's security if an admin user is targeted. The plugin's removal without a fix means all installations are effectively unmaintained and vulnerable.

Mitigation

No patched version exists, as the plugin was permanently closed from the WordPress.org directory on December 13, 2021, due to this security issue [1]. The only effective mitigation is to immediately uninstall the plugin from any WordPress site where it is active. Site administrators should also review for any other vulnerable plugins or themes that may have been introduced alongside myghpay. The plugin is not listed on any known KEV catalog as of this writing.