CVE-2024-3065 describes a Stored Cross-Site Scripting (XSS) vulnerability in the PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress, affecting all versions up to 1.7. This flaw stems from insufficient input sanitization and output escaping in admin settings, allowing authenticated administrators to inject malicious web scripts. The vulnerability primarily impacts multi-site WordPress installations or those with unfiltered_html disabled, leading to potential client-side script execution when a user accesses an affected page. Rated with a CVSS score of 4.4 (Medium), the attack requires high privileges (administrator-level) and has high attack complexity, with a low impact on confidentiality and integrity. The attack vector is network-based, but user interaction is not required once the script is injected. Currently, there is no evidence of active exploitation, nor is public exploit code available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 1.7CPE match | cpe:2.3:a:mohsinrasool:paypal_pay_now\,_buy_now\,_donation_and_cart_buttons_shortcode:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.