MyCryptoCheckout < 2.124 - Reflected XSS

Vulnerability

The MyCryptoCheckout WordPress plugin versions before 2.124 suffer from a reflected cross-site scripting (XSS) vulnerability. The plugin does not properly escape some URLs before outputting them in HTML attributes, allowing an attacker to inject arbitrary JavaScript code. The affected parameter is part of the URL handling mechanism within the plugin [1].

Exploitation

To exploit this vulnerability, an attacker must craft a malicious URL containing a JavaScript payload in the unsanitized parameter and lure a victim to click on it. The victim must be logged into a WordPress site running a vulnerable version of the plugin. No authentication or special privileges are required from the attacker beyond the ability to trick the user into visiting the crafted link [1].

Impact

Successful exploitation leads to reflected XSS, allowing the attacker to execute arbitrary JavaScript in the victim's browser within the context of the vulnerable WordPress site. This could be used to steal session cookies, perform actions on behalf of the victim, deface the site, or redirect the user to malicious destinations. The CVSS score is 7.5 (high) [1].

Mitigation

The issue is fixed in version 2.124 of the MyCryptoCheckout plugin. Users should update to this version or later. If updating is not possible, no workaround is documented in the available references; however, administrators can consider using a web application firewall to block malicious requests containing XSS payloads in the affected URL parameters [1].