How severe is CVE-2024-5448?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2024-5448 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Mohsinrasool Paypal Pay Now\, Buy Donation And Cart Buttons Shortcode

CVE-2024-5448

The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (23.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Mohsinrasool Paypal_pay_now\,_buy_now\,_donation_and_cart_buttons_shortcode
Unknown Paypal Pay Now, Buy Donation And Cart Buttons Shortcode — versions 0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)

Frequently asked questions

What is CVE-2024-5448?: CVE-2024-5448 is a medium-severity vulnerability in Mohsinrasool Paypal Pay Now\, Buy Donation And Cart Buttons Shortcode, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2024-06-21.
How severe is CVE-2024-5448?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2024-5448 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.