WordPress Exquisite PayPal Donation Plugin <= v2.0.0 is vulnerable to Cross Site Scripting (XSS)

Vulnerability

The Exquisite PayPal Donation plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including v2.0.0. The issue requires authenticated access with administrator-level privileges to exploit. The vulnerable code path allows injection of arbitrary JavaScript that persists on the server and executes in the context of other admin users' browsers.

Exploitation

An attacker needs valid WordPress administrator credentials to access the plugin's settings pages where input fields are not properly sanitized. The attack involves saving a crafted payload (e.g., ``) into a plugin configuration field. No additional user interaction is required beyond the administrator saving the malicious input.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the browsers of other administrators who visit the affected plugin pages. This can lead to session hijacking, defacement, or further privilege escalation within the WordPress admin dashboard. The attack achieves information disclosure and unauthorized actions at the admin level.

Mitigation

As of March 28, 2023, the plugin has been closed and removed from the WordPress.org plugin directory due to a security issue. No patched version has been released. Users who have this plugin installed should immediately uninstall it. There is no known workaround other than removing the plugin entirely. The plugin is considered end-of-life and should not be used. [1]