CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Stored XSS.This issue affects Checkout for PayPal: from n/a through <= 1.0.38.
Explanation of Vulnerability in Simple Terms
Checkout for PayPal versions up to 1.0.38 contain a cross-site scripting (XSS) vulnerability that allows an authenticated user to inject malicious scripts. The vulnerability requires user interaction and can affect other users or site functionality. Site administrators should update to a version newer than 1.0.38 to remediate this issue.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they interact with the checkout page.
Potential impact on your site
Customers' sessions could be compromised, payment data exposed, or site functionality disrupted through injected scripts.
Conditions required to exploit
Attacker must be logged in as a low-privilege user and trick a victim into visiting a crafted link or page.
Key dates
External resources
