Pay For Post with WooCommerce <= 3.2.34 - Unauthenticated Reflected Cross-Site Scripting via Pricing Page URL Parameters
- ID
- WPSEC-2026-1047
- Plugin
- Pay For Post with WooCommerce (woocommerce-pay-per-post)
- Affected
- all versions before 3.2.35
- Remediation
- Update to 3.2.35 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- Pay For Post with WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Pay For Post with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting and pricing configuration injection via URL parameters on the bundled Freemius SDK pricing page in all versions up to, and including, 3.2.34. This is due to arbitrary GET parameters being merged over trusted pricing app configuration values (such as contact_url, fs_wp_endpoint_url, request_handler_url and plugin_icon) without validation. This makes it possible for unauthenticated attackers to make the pricing page's links and requests point to attacker-controlled locations, including javascript: URLs that run arbitrary script in the administrator's session when clicked. The attacker has to trick a site administrator into opening a crafted link and interacting with the page.
References
- https://wpsec.com/vuln/WPSEC-2026-1047/
- https://plugins.svn.wordpress.org/woocommerce-pay-per-post/tags/3.2.35/
- https://wordpress.org/plugins/woocommerce-pay-per-post/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS