The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WooCommerce Placetopay Gateway Belice
Vendor
evertec
Product
WooCommerce Placetopay Gateway Belice
Platforms
Unknown
Default status
unaffected
WooCommerce Placetopay Gateway Belice · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.2
None listed
WooCommerce Placetopay Gateway Ecuador
Vendor
evertec
Product
WooCommerce Placetopay Gateway Ecuador
Platforms
Unknown
Default status
unaffected
WooCommerce Placetopay Gateway Ecuador · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.2
None listed
WooCommerce Placetopay Gateway Colombia
Vendor
evertec
Product
WooCommerce Placetopay Gateway Colombia
Platforms
Unknown
Default status
unaffected
WooCommerce Placetopay Gateway Colombia · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.2
None listed
WooCommerce Placetopay Gateway Uruguay
Vendor
evertec
Product
WooCommerce Placetopay Gateway Uruguay
Platforms
Unknown
Default status
unaffected
WooCommerce Placetopay Gateway Uruguay · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.2
None listed
WooCommerce Placetopay Gateway
Vendor
evertec
Product
WooCommerce Placetopay Gateway
Platforms
Unknown
Default status
unaffected
WooCommerce Placetopay Gateway · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.2
None listed
WooCommerce Placetopay Gateway Honduras
Vendor
evertec
Product
WooCommerce Placetopay Gateway Honduras
Platforms
Unknown
Default status
unaffected
WooCommerce Placetopay Gateway Honduras · Scoped product and version facts