WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page

2022-05-1100:00:00

Andrea

woocommerce

green wallet gateway

reflected xss

checkout page

EPSS

0.001

Percentile

40.2%

JSON

The plugin does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.

1. Enable greenwallet-gateway as a woocommerce payment gateway
2. add something in your cart and visit the checkout page
3. visit website/checkoutpage/?error_envision=<script>alert(1)</script>

EPSS

0.001

Percentile

40.2%

JSON

Related for WPEX-ID:14283389-A6B8-4DD8-9441-F16FCC4AB3C0