Payflex Payment Gateway
Monthly
Reflected cross-site scripting in the Tomlister Payflex Payment Gateway WordPress plugin (versions through 2.7.1) lets remote attackers inject script into a page generated by the plugin, which then executes in the browser of any victim who is persuaded to open a crafted URL. The CVSS vector requires user interaction (UI:R) and carries a scope change (S:C), so the practical payoff is theft of session or authentication tokens and manipulation of the rendered payment/admin page rather than any server-side compromise, with the highest value realized when the victim is a privileged WordPress user. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was provided in the source data.
Reflected cross-site scripting in the Tomlister Payflex Payment Gateway WordPress plugin (versions through 2.7.1) lets remote attackers inject script into a page generated by the plugin, which then executes in the browser of any victim who is persuaded to open a crafted URL. The CVSS vector requires user interaction (UI:R) and carries a scope change (S:C), so the practical payoff is theft of session or authentication tokens and manipulation of the rendered payment/admin page rather than any server-side compromise, with the highest value realized when the victim is a privileged WordPress user. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was provided in the source data.