CVE-2024-3065: 
WordPress vulnerability analysis and mitigation

The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-3065) affecting all versions up to and including 1.7. The vulnerability was discovered and disclosed on May 22, 2024, and the plugin has been subsequently closed on May 20, 2024 due to security issues (NVD CVE, WordPress Plugin).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's admin settings. This security flaw allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. The vulnerability has been assigned a CVSS v3.1 score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N (Wordfence Intel).

The vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled. When exploited, the injected malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user interactions (NVD CVE).

The vulnerability requires an authenticated attacker with administrator-level permissions to exploit. While this limits the potential attack surface, it represents a significant risk in environments where multiple administrators have access to the WordPress installation (NVD CVE).

The plugin has been closed and is no longer available for download from the WordPress plugin repository as of May 20, 2024. Users are advised to remove the plugin from their WordPress installations to mitigate the security risk (WordPress Plugin).