CVE-2024-3065

Vulnerability

The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 1.7. This is due to insufficient input sanitization and output escaping. The vulnerability is only exploitable on multi-site installations or installations where the unfiltered_html capability has been disabled. The plugin has been closed and removed from the WordPress.org plugin directory as of May 20, 2024, citing a security issue [1].

Exploitation

An attacker must have administrator-level permissions (or above) to exploit this vulnerability. The attacker can inject arbitrary web scripts through the plugin's admin settings. Once saved, the injected script will execute whenever any user accesses the affected page. No additional user interaction is required beyond the attacker saving the malicious settings.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of any user visiting the injected page. This can lead to session hijacking, defacement, redirection to malicious sites, or other client-side attacks. The attacker already has admin-level access, but the XSS can target lower-privileged users or visitors.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of May 20, 2024, and no patched version is available [1]. Users who have the plugin installed should uninstall it immediately. There is no workaround other than complete removal of the plugin.