Technical impact
The Transbank Webpay WordPress plugin before version 1.14.0 logs data without sanitizing or escaping it. When the logs are displayed in the WordPress admin area, the unsanitized content is rendered directly, allowing the injection of malicious JavaScript. This flaw satisfies the definition of a stored cross‑site scripting vulnerability (CWE‑79).
Affected Systems
WordPress sites that run the Transbank Webpay plugin with a version older than 1.14.0 are impacted. The problem resides in the plugin’s logging component, which is accessible to anyone who can interact with the plugin’s endpoints, regardless of authentication status.
Risk and Exploitability
The CVSS score is 7.1 and the EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog, so the precise exploitation probability is uncertain. However, the description indicates that unauthenticated users may inject code via the logging mechanism, which is a well‑known high‑risk vector for compromising administrator accounts when the user later views the affected logs. The lack of a known exploit reference suggests that it has not yet been widely abused, but the mechanism remains available for attackers who can identify sites running the vulnerable plugin.
