CVE-2024-13728

CVE-2024-13728 is a cross-site scripting (XSS) vulnerability found in the Scott Paterson Accept Donations with PayPal & Stripe Plugin for WordPress, specifically versions prior to 1.4.4. The vulnerability stems from improper handling of the "rf" parameter, allowing attackers to inject malicious scripts. These scripts can then be executed in the browsers of unsuspecting users who visit the affected website. The vulnerability was publicly disclosed on January 24, 2025, and further details are available from Wordfence. Users of the plugin are strongly encouraged to update to version 1.4.4 or later to mitigate the risk associated with this vulnerability. Cross-site scripting vulnerabilities can have various consequences, including session hijacking, data theft, and redirection to malicious websites.