CVE-2024-11228

Name of the Vulnerable Software and Affected Versions 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 versions up to, and including, 5.1.4

Description The issue is related to Stored Cross-Site Scripting via the plugin's pafw instant payment shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 5.1.4, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the pafw instant payment shortcode to minimize the risk of exploitation.