Description

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:34.690Z",
  "pubdate": "2026-08-20T12:16:34.690Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Paymob for WooCommerce plugin in versions less than or equal to 4.1.10. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered to legitimate users visiting the affected e-commerce platform.\nThe primary impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users or administrators, and the potential redirection of victims to malicious external domains. Given that the vulnerability requires no prior authentication or elevated privileges, the attack surface is broadly exposed to any external network user interacting with the vulnerable endpoints.\nExploitation relies on the application's failure to properly sanitize or encode user-supplied input before reflecting it back within the Document Object Model (DOM). The risk implication is severe, as successful execution of arbitrary scripts within the context of a victim's browser session compromises the confidentiality, integrity, and availability of user data and interactions handled by the affected WordPress e-commerce deployment.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the Paymob for WooCommerce plugin for versions <= 4.1.10. Specifically, the root cause stems from insufficient input sanitization and a lack of proper contextual output encoding for parameters processed and reflected by the plugin.\nAs an unauthenticated Cross-Site Scripting (XSS) vector, the affected component fails to validate untrusted data entering the application via HTTP requests before generating the dynamic response. Because no authentication requirements or privilege requirements are enforced on the vulnerable endpoints, any remote attacker operating over the network can craft a malicious HTTP request containing malicious JavaScript payloads.\nThe attack flow proceeds as follows: First, the attacker constructs a specially crafted URL or HTTP request containing the malicious script payload targeting a vulnerable parameter processed by the Paymob for WooCommerce plugin. Second, the victim is induced to click the malicious link or visit the crafted URL via social engineering or other delivery mechanisms. Third, the server processes the request and reflects the unsanitized payload directly into the HTTP response body without applying robust HTML or JavaScript encoding. Fourth, the victim's browser parses the response, executing the injected script within the security context of the origin site.\nThe payload behavior includes executing arbitrary JavaScript in the victim's browser session, granting the attacker access to Document cookies, LocalStorage, and SessionStorage. Post-exploitation impact encompasses session hijacking, DOM manipulation, bypassing access controls, performing unauthorized administrative or transactional actions if an administrator interacts with the payload, and defacing the e-commerce storefront.\nNetwork exposure is fully external, as the vulnerable components are directly accessible via standard web protocols (HTTP/HTTPS) without requiring prior session establishment or valid credentials."
}