CVE-2023-1469

MEDIUM 4.4

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.

Vendor	mra13
Product	wp express checkout (accept paypal payments easily)
Published	Mar 17, 2023
Last Updated	Feb 5, 2025

Stay Ahead of the Next One

Get instant alerts for mra13 wp express checkout (accept paypal payments easily)

Be the first to know when new medium vulnerabilities affecting mra13 wp express checkout (accept paypal payments easily) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

mra13 / WP Express Checkout (Accept PayPal Payments Easily)

2.2.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2879453%40wp-express-checkout&new=2879453%40wp-express-checkout&sfp_email=&sfph_mail=

Credits

Ayoub Safa