CVE-2026-66611 in Paymob Plugin
Summary
by MITRE • 08/20/2026
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified as an unauthenticated Cross-Site Scripting flaw within the Paymob plugin for WordPress, specifically affecting versions up to and including 4.1.10, represents a significant security risk to e-commerce environments utilizing this payment gateway integration. This type of attack allows malicious actors to inject client-side scripts into web pages viewed by other users without requiring any form of authentication or prior login credentials. The absence of an access control mechanism for the vulnerable endpoint means that any internet user can trigger the execution of arbitrary JavaScript code within the context of the victim's session, bypassing standard security boundaries such as the same-origin policy which normally restricts how a document loaded from one origin interacts with resources from another origin.
From a technical perspective, this vulnerability typically stems from insufficient input validation and output encoding when handling user-supplied data that is reflected back into the HTML response or stored in the database for later retrieval. In the context of WordPress plugins like Paymob, such flaws often occur in parameters related to payment redirection URLs, webhook responses, or form fields where special characters are not properly sanitized before being rendered by the browser. When a victim visits a maliciously crafted URL containing embedded script tags or event handlers, the web server processes the request and returns it with the injected payload intact. The browser then executes this code as if it originated from the trusted domain of the WordPress site, granting the attacker elevated privileges within that context.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Attackers can perform a variety of malicious actions on behalf of authenticated users who visit the compromised page. These actions include stealing session cookies and authentication tokens, which could lead to full account takeover if combined with other techniques like cross-site request forgery or token theft via keyloggers injected through XSS. Furthermore, attackers can redirect victims to phishing sites designed to steal sensitive financial information such as credit card details or login credentials for the WordPress admin panel. In some cases, persistent stored XSS variants could allow an attacker to deface the website by modifying its content dynamically or installing malware on visitors' devices through drive-by download techniques that exploit browser vulnerabilities triggered by the injected script.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-79 Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting, and specifically reflects issues related to insufficient validation on untrusted data inputs. In terms of the MITRE ATT&CK framework, this falls under the Tactic Execution with techniques like Command and Scripting Interpreter or potentially Injection attacks depending on how the payload is constructed and executed within the browser environment. The lack of authentication required for exploitation places it in a high-severity category because it lowers the barrier to entry significantly, allowing non-privileged users to initiate complex attack chains that compromise confidentiality, integrity, and availability of user data.
Mitigation strategies must focus on immediate remediation through software updates as well as defensive coding practices. The primary solution is to upgrade the Paymob for WooCommerce plugin to a version greater than 4.1.10 where this vulnerability has been patched by the developers with proper input sanitization and output encoding mechanisms implemented. For organizations unable to update immediately, temporary mitigations include implementing Web Application Firewall rules that detect and block common XSS payloads in HTTP requests targeting the vulnerable endpoints. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of successful injection attempts by restricting the sources from which scripts are allowed to execute, thereby preventing the malicious code from performing destructive actions even if it is injected into the page source.