CVE-2021-47948

Published
View on NVD ↗
CVSS v3
5.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during payment form creation, which gets stored in the database and executed in the browser when the form is viewed.

<h4>Lightweight, extensible, and easy-to-use Online Payments and Invoicing plugin.</h4> <p>GetPaid can be used as a payment system for 3rd party plugins too.</p> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/gGtehIjDG3E?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span> <h4>Features</h4> <ul> <li>Create items with a one-time fee or recurring payments (subscriptions).</li> <li>Add a free trial and/or allow buyers to name their price.</li> <li>Add items to your website via Buy Now Buttons. Customers can buy on your website via several Payment Gateways.</li> <li>Create inline checkout forms to sell items through an optimized landing page.</li> <li>Create Invoices that you can send to your customers, who can pay online.</li> <li>Create quotes and estimates to send to your clients <a href="https://wordpress.org/plugins/invoicing-quotes/" rel="ugc">requires GetPaid quotes add-on</a></li> <li>Quotes can be turned into invoices, and clients can pay online.</li> <li>Create and send invoices directly to receive single or recurring payments.</li> <li>Accept payments via <a href="https://wordpress.org/plugins/getpaid-stripe-payments/" rel="ugc">Stripe</a> &#8211; (requires GetPaid Stripe add-on), Paypal Standard, Authorize.net, WorldPay and Pre Bank Transfer (other payment gateways available as premium add-ons).</li> <li>Export payments and any other data through the reporting system.</li> <li>Manage taxes.</li> <li>VAT MOSS complaint (European Union VAT management system).</li> <li>Easily accept payments and create invoices programmatically through other plugins.</li> </ul> <h4>A payment system for other plugins and themes</h4> <p>GetPaid can be used as a payment system with a checkout page by any plugin.</p> <p><a href="https://wpgetpaid.com/docs/adding-a-custom-item-type/" rel="nofollow ugc">Here you find instructions on integrating any plugin with GetPaid.</a></p> <h4>Plugins currently using GetPaid as their Payment system are</h4> <ul> <li><a href="https://wpgeodirectory.com/" rel="nofollow ugc">GeoDirectory</a> &#8211; GeoDirectory uses GetPaid to manage Invoices, taxes, VAT, and payments.</li> </ul> <h4>Payment Gateways</h4> <ul> <li>PayPal Standard (built-in) &#8211; Accept Paypal and credit card payments (single or recurring) via PayPal.</li> <li>Authorize.Net (built-in) &#8211; Accept credit card payments (single or recurring) via Authorize.Net.</li> <li>Worldpay (built-in) &#8211; Accept credit card payments via Worldpay.</li> <li>Pre-Bank Transfer (built-in) &#8211; Instruct users to send you a bank transfer, which you can later mark as paid.</li> <li><a href="https://wordpress.org/plugins/getpaid-stripe-payments/" rel="ugc">Stripe</a> &#8211; Accept credit card payments (single or recurring) directly on your website via Stripe.</li> <li><a href="https://wpgetpaid.com/downloads/paypal-pro-payment-gateway/" rel="nofollow ugc">PayPal Pro</a> &#8211; Accept PayPal and credit card payments (single or recurring) directly on your website.</li> <li><a href="https://wpgetpaid.com/downloads/payfast-payment-gateway/" rel="nofollow ugc">PayFast</a> &#8211; Accept payments via PayFast.</li> <li><a href="https://wpgetpaid.com/downloads/cheque-payment-gateway/" rel="nofollow ugc">Cheque Payment</a> &#8211; Accept payments via Cheques</li> <li><a href="https://wpgetpaid.com/downloads/mollie-payment-gateway/" rel="nofollow ugc">Mollie</a> &#8211; Accept payment via Mollie (EUR only)</li> <li><a href="https://wpgetpaid.com/downloads/gocardless-payment-gateway/" rel="nofollow ugc">GoCardless</a> &#8211; Accept payments via GoCardless (direct debits)</li> <li><a href="https://wpgetpaid.com/downloads/sage-pay-payment-gateway/" rel="nofollow ugc">Sage Pay</a> &#8211; Accept payments via Sage Pay</li> <li><a href="https://wpgetpaid.com/downloads/2checkout-payment-gateway/" rel="nofollow ugc">2CheckOut</a> &#8211; Accept payments (single or recurring) via 2CO.</li> <li><a href="https://wpgetpaid.com/downloads/cash-on-delivery-payment-gateway/" rel="nofollow ugc">Cash on Delivery</a> &#8211; Accept payments via Cash on Delivery</li> <li><a href="https://wpgetpaid.com/downloads/payumoney-payment-gateway/" rel="nofollow ugc">PayUmoney</a> &#8211; Accept payments via PayUmoney</li> <li><a href="https://wpgetpaid.com/downloads/payumoney-payment-gateway/" rel="nofollow ugc">WebPay</a> &#8211; Accept payments via WebPay</li> <li><a href="https://wpgetpaid.com/downloads/payumoney-latam-payment-gateway/" rel="nofollow ugc">PayUmoney Latam</a> &#8211; Accept payments via PayUmoney Latam</li> <li><a href="https://wpgetpaid.com/downloads/paypal-payflow-payment-gateway/" rel="nofollow ugc">PayPal Payflow</a> &#8211; Accept credit card payments (single or recurring) directly on your website.</li> <li><a href="https://wpgetpaid.com/downloads/square-payment-gateway/" rel="nofollow ugc">Square</a> &#8211; Accept payments via Square</li> <li><a href="https://wpgetpaid.com/downloads/firstdata-payment-gateway/" rel="nofollow ugc">First Data</a> &#8211; Accept payments via FirstData</li> <li><a href="https://wpgetpaid.com/downloads/braintree-payment-gateway/" rel="nofollow ugc">Braintree</a> &#8211; Accept payments via Braintree</li> <li><a href="https://wpgetpaid.com/downloads/eway-payment-gateway/" rel="nofollow ugc">eWay</a> &#8211; Accept payments via eWAY payment gateway</li> </ul> <h4>Add-ons</h4> <ul> <li><a href="https://wordpress.org/plugins/invoicing-quotes/" rel="ugc">Quotes</a> &#8211; Create quotes, send them to clients, and convert them to Invoices when accepted by the customer</li> <li><a href="https://wordpress.org/plugins/getpaid-wallet/" rel="ugc">Wallet</a> &#8211; Topup and withdraw money from your wallet while also being able to use the balance at checkout</li> <li><a href="https://wordpress.org/plugins/getpaid-item-inventory/" rel="ugc">Item Inventory</a> &#8211; Set stock levels for individual items</li> <li><a href="https://wpgetpaid.com/downloads/pdf-invoices/" rel="nofollow ugc">PDF Invoices</a> &#8211; Send PDF invoices via email or let users download them</li> <li><a href="https://wpgetpaid.com/downloads/affiliatewp-integration/" rel="nofollow ugc">AffiliateWP Integration</a> &#8211; Integrate with the <a href="https://affiliatewp.com/" rel="nofollow ugc">AffiliateWP plugin</a></li> <li><a href="https://wpgetpaid.com/downloads/contact-form-7/" rel="nofollow ugc">Contact form 7</a> &#8211; Send an invoice/quote when a user fills out a form</li> <li><a href="https://wpgetpaid.com/downloads/gravity-forms/" rel="nofollow ugc">Gravity Forms</a> &#8211; Send an invoice/quote when a user fills out a form</li> <li><a href="https://wpgetpaid.com/downloads/ninja-forms/" rel="nofollow ugc">Ninja Forms</a> &#8211; Send an invoice/quote when a user fills out a form</li> <li><a href="https://wpgetpaid.com/downloads/digital-downloads/" rel="nofollow ugc">Digital Downloads</a> &#8211; Sell digital files such as eBooks, Music, Videos, or Software</li> <li><a href="https://wpgetpaid.com/downloads/custom-item-success-page/" rel="nofollow ugc">Custom Item Success Page</a> &#8211; Redirect buyers to different success pages according to the item purchased</li> <li><a href="https://wpgetpaid.com/downloads/advertising/" rel="nofollow ugc">Advertising</a> &#8211; Sell Ads on your WordPress website (Fully integrated with GeoDirectory)</li> <li><a href="https://wpgetpaid.com/downloads/sales-funnels/" rel="nofollow ugc">Sales Funnels</a> &#8211; Easily create simple Sales Funnels with Order Bumps, Upsell and Downsell Offers</li> <li><a href="https://wpgetpaid.com/downloads/simple-quantity-discounts/" rel="nofollow ugc">Simple Quantity Discounts</a> &#8211; Set discounts for Bulk orders</li> <li><a href="https://wpgetpaid.com/downloads/paid-trials/" rel="nofollow ugc">Paid Trials</a> &#8211; Offer Paid Trials.</li> </ul> <p>New Payment Gateways and Add-ons will be created regularly. If there is a Payment Gateway that you need urgently or a feature missing that you think we must add, <a href="https://wpgetpaid.com/contact-form/" rel="nofollow ugc">get in touch with us</a> and we will consider it.</p> <h4>Support</h4> <p>Get timely and friendly support for both Core Plugin and add-ons at our official website, <a href="https://wpgetpaid.com/support/" rel="nofollow ugc">GetPaid Support</a></p> <h4>Origin</h4> <p>Work on GetPaid ( AKA Get Paid or wpGetPaid ) started in April 2016.<br /> We are proud the original base of the plugin was a fork of <a href="https://wordpress.org/plugins/easy-digital-downloads/" rel="ugc">EDD</a> with permission from Pippin.<br /> Additionally, we are proud of some code from <a href="https://wordpress.org/plugins/sliced-invoices/" rel="ugc">Sliced Invoices</a> by David Grant, which was used in places, mostly for his beautiful invoice layout.<br /> We worked on the plugin for over a year before it got its first public release, we stripped down the code to make it a simple lightweight payment and invoicing plugin with many additional features to fit the needs of our customers.</p> <p>This product includes GeoLite2 data created by MaxMind, available from<br /> <a href="https://www.maxmind.com" rel="nofollow ugc">https://www.maxmind.com</a></p>
WordPress Plugin DirectoryWordPress Plugin Directory
425K