CVE-2024-13543

MEDIUMNuclei

Zarinpal Paid Downloads <= 2.3 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13543 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 11, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zarinpal Paid Download

Default status: affected

CVE ListThrough 2.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMZarinpal Paid Download - Reflected XSSCVSS 6.1

Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires attacker to craft a malicious link.

Impact

Attackers can execute malicious scripts in the context of high privilege users, potentially leading to session hijacking or account compromise.

Remediation

Update to the latest version of the plugin where the vulnerability is fixed or implement proper sanitization and escaping measures.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024amini7zarinpal-paid-downloadwordpresswpwp-pluginauthenticatedxss
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:amini7:zarinpal_paid_download:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/04a545c4-75d3-4672-8530-00bb879991ca/ https://nvd.nist.gov/vuln/detail/CVE-2024-13543

Source: ProjectDiscovery

References

2