CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.6.1.
Explanation of Vulnerability in Simple Terms
The Robokassa payment gateway for WooCommerce contains a cross-site scripting (XSS) vulnerability in versions up to 1.6.1. An attacker can inject malicious scripts that execute in a victim's browser when they interact with the payment gateway. The vulnerability affects the integrity and confidentiality of user data, and impacts extend beyond the vulnerable component itself.
What an attacker can do
Inject malicious scripts that run in a customer's browser during payment processing.
Potential impact on your site
Customer payment data and session tokens could be stolen; site reputation damaged if customers are redirected to phishing pages.
Conditions required to exploit
Victim must visit a malicious link or page that triggers the vulnerable payment gateway code.
Key dates
External resources
Related vulnerabilities
