High · published January 31, 2026
🚨 An unauthenticated attacker can inject malicious scripts directly into your admin's dashboard! The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is at risk, and all versions up to 1.5 are affected! ⚡ Think of it like a mischievous delivery person slipping a fake package into your lobby; when you go to sign for it, the surprise is a nasty prank instead of your expected delivery. That’s what happens when administrators access the Orders page without proper sanitization! Once an attacker injects their script, it executes every time an admin opens the Orders page. This could lead to data theft, unauthorized actions on your site, or worse—complete control over the admin account! 🥵 It's not just a disruption; it's a potential disaster for your site's integrity!
Think of it like a mischievous delivery person slipping a fake package into your lobby; when you go to sign for it, the surprise is a nasty prank instead of your expected delivery. That’s what happens when administrators access the Orders page without proper sanitization! This vulnerability stems from insufficient input sanitization and output escaping in the 'orderform_data' AJAX action, allowing malicious scripts to be stored and executed whenever an admin accesses the affected page.
Once an attacker injects their script, it executes every time an admin opens the Orders page. This could lead to data theft, unauthorized actions on your site, or worse—complete control over the admin account! 🥵 It's not just a disruption; it's a potential disaster for your site's integrity! Upgrade immediately to version 1.5 or later to mitigate this risk. Additionally, review and sanitize any user inputs, and consider implementing Content Security Policy headers to further protect your site. 🛡️ You've got this! Follow these steps, and you'll keep your site secure and your admin dashboard safe! 🚀