Stripe Green Downloads WordPress Plugin Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in the Stripe Green Downloads WordPress Plugin version 2.03. This vulnerability allows remote attackers to inject malicious scripts into button label fields. Exploitation of this issue could lead to session hijacking and manipulation of application modules.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, a user must have access to the WordPress admin panel with moderator privileges. Once logged in, navigate to the 'Green Downloads - Settings - Button' module. Inject a script into the 'Label', 'Processing label', or 'Download label' fields. After saving the changes, the injected script will execute in the preview context, demonstrating the cross-site scripting vulnerability.