CVE-2015-7666 – Payment Form for PayPal Pro < 1.0.2 - Reflected Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2015-7666

Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter. Múltiples vulnerabilidades de Cross-Site Scripting (XSS) en las funciones (1) cp_updateMessageItem y (2) cp_deleteMessageItem en cp_ppp_admin_int_message_list.inc.php en el plugin Payment Form for PayPal Pro, en versiones anteriores a la 1.0.2 para WordPress, permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro cal. WordPress DWBooster Payment Form for PayPal Pro plugin version 1.0.1 suffers from a cross site scripting vulnerability. • http://www.securityfocus.com/archive/1/536602/100/0/threaded https://plugins.trac.wordpress.org/changeset/1254452/payment-form-for-paypal-pro https://wordpress.org/plugins/payment-form-for-paypal-pro/#developers https://wpvulndb.com/vulnerabilities/8210 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •