PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Contributor+ Stored XSS

Vulnerability

The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through version 1.7 fails to validate and escape shortcode attributes before outputting them in a page or post. This allows users with the contributor role and above, who have the ability to insert shortcodes, to inject arbitrary HTML and JavaScript [1].

Exploitation

An attacker with at least the contributor role can craft a shortcode (e.g., [paypal]) with a malicious attribute value containing JavaScript. When the shortcode is rendered on the frontend, the script executes in the browsers of visitors viewing the page or post [1].

Impact

Successful exploitation leads to stored cross-site scripting (XSS), enabling the attacker to execute arbitrary JavaScript in the context of the victim's session. This can result in data theft, session hijacking, or defacement [1].

Mitigation

As of the publication date, no fix has been released. The affected version is 1.7 and earlier. Users are advised to restrict the contributor role's ability to use shortcodes or to disable the plugin until a patch is available [1].