PT-2025-5104 · WordPress · Wp Service Payment Form With Authorize.Net

0Xd4Rk5Id3 · Published 2025-01-16 · Updated 2025-01-17 · CVE-2025-23804

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Service Payment Form With Authorize.net versions n/a through 2.6.0

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. The vulnerability is present in the WP Service Payment Form With Authorize.net plugin, allowing for reflected XSS attacks. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions n/a through 2.6.0, update to a version later than 2.6.0 to resolve the issue. At the moment, there is no information about additional mitigation measures.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-23804

Affected Products

Wp Service Payment Form With Authorize.Net

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-23804 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-service-payment-form-with-authorizenet/vulnerability/wordpress-wp-service-payment-form-with-authorize-net-plugin-2-6-0-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/wp-service-payment-form-with-authorizenet/vulnerability/wordpress-wp-service-payment-form-with-authorize-net-plugin-2-6-0-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1880248088121737692 · Twitter Post