CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1465 – WP EasyPay < 4.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-1465
01 May 2023 — The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin The WP EasyPay plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 4.0.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i... • https://wpscan.com/vulnerability/13f59eb4-0744-4fdb-94b5-886ee6bdd867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-47177 – WordPress WP EasyPay Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2022-47177
14 Apr 2023 — Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions. The WP EasyPay plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.4. This is due to missing nonce validation on several of the plugin's functions. This makes it possible for unauthenticated attackers to invoke this function and modify plugin settings via a forged request, granted they can trick a site administrator into performing an act... • https://patchstack.com/database/vulnerability/wp-easy-pay/wordpress-wp-easypay-square-for-wordpress-plugin-4-0-4-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4411 – WP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass
https://notcve.org/view.php?id=CVE-2021-4411
05 Jul 2021 — The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpep_download_transaction_in_excel() function. This makes it possible for unauthenticated attackers to trigger a transactions download via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks • CWE-352: Cross-Site Request Forgery (CSRF) •