TI-2025-11017 CVE-2025-12017 · GHSA-73h2-6r4h-p6jq
VNPAY for Woocommerce <= 1.0.0 - Reflected Cross-Site Scripting
Priority LOW 27
The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output esc…