[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuK0J6JNJV_18Z_28GIhI7-3zTypjBQQbbJx7GDLweEc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":33,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":39},"CVE-2026-6939","corvuspay-woocommerce-payment-gateway-unauthenticated-stored-cross-site-scripting-via-approvalcode-parameter","CorvusPay WooCommerce Payment Gateway \u003C= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter","The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST \u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.","corvuspay-woocommerce-integration",null,"\u003C=2.7.4","2.7.5","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 16:43:03","2026-07-11 05:35:50",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fd8a81c01-495f-4861-b66f-000072e99512?source=api-prod",1,[22,23,24,25,26,27],"assets\u002Fimg\u002Fcards\u002Fdina.svg","corvuspay-woocommerce-integration.php","includes\u002Fclass-wc-gateway-corvuspay.php","includes\u002Fclass-wc-order-corvuspay.php","languages\u002Fcorvuspay-woocommerce-integration.pot","readme.txt","researched",false,3,"I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or specific attack instructions for real-world software vulnerabilities. My safety guidelines prioritize the prevention of potential real-world harm, and providing detailed guides for exploiting vulnerabilities in specific software—even for research purposes—falls under high-severity restricted content.\n\nFor information on how to secure WordPress installations and defend against vulnerabilities like Stored Cross-Site Scripting (XSS), I recommend consulting the following resources:\n\n*   **OWASP XSS Prevention Cheat Sheet**: A comprehensive guide on preventing XSS in various web environments.\n*   **WordPress Plugin Handbook (Security Section)**: Official documentation on best practices for data sanitization, validation, and escaping in WordPress development.\n*   **Common Vulnerabilities and Exposures (CVE) Database**: For general information regarding the status and description of known security issues.","The CorvusPay WooCommerce Payment Gateway plugin is vulnerable to unauthenticated Stored Cross-Site Scripting because its success callback handler stores the 'approval_code' parameter without sanitization and fails to enforce signature validation. This allows unauthenticated attackers to inject malicious JavaScript into an order's metadata, which is later executed when an administrator views the order in the WordPress dashboard.","\u002F\u002F includes\u002Fclass-wc-order-corvuspay.php lines 205-212\n\t\t\tif ( 'callback-signed' === $type ) {\n\t\t\t\tif ( isset( $this->parameters[\"approval_code\"] ) && $this->parameters[\"approval_code\"] != null ) {\n\t\t\t\t\t$this->update_meta_data( '_corvuspay_approval_code', $this->parameters[\"approval_code\"] );\n\t\t\t\t\t$this->update_meta_data( '_corvuspay_transaction_date', current_time( \"d.m.Y H:i:s\" ) );\n\t\t\t\t}\n                $res = $this->client->validate->signature( $this->parameters );\n                $this->log->debug( 'Result from signature validation: ' . $res );\n\t\t\t}","--- includes\u002Fclass-wc-order-corvuspay.php\n+++ includes\u002Fclass-wc-order-corvuspay.php\n@@ -204,11 +204,13 @@\n \t\t\tparent::__construct( $post_id );\n \t\t\t\n \t\t\tif ( 'callback-signed' === $type ) {\n+\t\t\t\t$res = $this->client->validate->signature( $this->parameters );\n+\t\t\t\tif ( ! $res ) {\n+\t\t\t\t\tthrow new Exception( 'Invalid signature.' );\n+\t\t\t\t}\n \t\t\t\tif ( isset( $this->parameters[\"approval_code\"] ) && $this->parameters[\"approval_code\"] != null ) {\n-\t\t\t\t\t$this->update_meta_data( '_corvuspay_approval_code', $this->parameters[\"approval_code\"] );\n+\t\t\t\t\t$this->update_meta_data( '_corvuspay_approval_code', sanitize_text_field( $this->parameters[\"approval_code\"] ) );\n \t\t\t\t\t$this->update_meta_data( '_corvuspay_transaction_date', current_time( \"d.m.Y H:i:s\" ) );\n \t\t\t\t}\n-                $res = $this->client->validate->signature( $this->parameters );\n-                $this->log->debug( 'Result from signature validation: ' . $res );\n \t\t\t}\n \t\t} elseif ( 'api' === $type || 'api-status' === $type || 'api-renew' === $type ) {","1. Send a POST request to the unauthenticated REST endpoint \u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F.\n2. In the request body, include a valid 'order_number' (associated with an existing WooCommerce order) and a malicious 'approval_code' parameter containing an XSS payload (e.g., \u003Cscript>alert(1)\u003C\u002Fscript>).\n3. Include a dummy 'signature' parameter; the vulnerable plugin logs validation results but continues execution even if the signature is invalid.\n4. The malicious script is saved to the order's metadata in the database without sanitization.\n5. The payload executes in the session of any administrator who views the targeted order in the WooCommerce admin dashboard.","gemini-3-flash-preview","2026-07-15 08:36:10","2026-07-15 08:37:04",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","2.7.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags\u002F2.7.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcorvuspay-woocommerce-integration.2.7.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags\u002F2.7.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcorvuspay-woocommerce-integration.2.7.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags"]