Description
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Accept Stripe Payments | < 2.1.4 | 2.1.4 |
References
- https://wpscan.com/vulnerability/0e4bbbde-b93e-4b58-8baf-301073e9a0c5/ exploit vdb-entry technical-description