A stored Cross-Site Scripting vulnerability in the Transbank Webpay plugin allows unauthenticated attackers to hijack administrator sessions via malicious log entries.

This is a stored Cross-Site Scripting (XSS) vulnerability caused by the failure to sanitize or HTML-encode log data. Unauthenticated attackers can inject malicious scripts into the plugin's logs, which then execute when an administrator views the logs in the WordPress dashboard.

The CVSS score of 7.1 highlights the critical risk of this vulnerability. Because the script executes in the browser of an administrator, an attacker can achieve session hijacking, steal sensitive administrative credentials, or perform unauthorized administrative actions, leading to a complete compromise of the WordPress site.

Immediate Action: Upgrade the Transbank Webpay WordPress plugin to version 1.14.0 or later to patch the underlying sanitization flaw.

Proactive Monitoring: Audit existing plugin logs for any suspicious or non-standard entries that may contain obfuscated JavaScript or script tags.

Compensating Controls: Utilize a WAF to inspect incoming traffic and block requests containing script injection patterns before they reach the plugin's logging functionality.

Public Exploit Available: false

This vulnerability is particularly dangerous because it does not require prior authentication to trigger. Immediate patching is required to prevent attackers from using the logging mechanism as a persistence or privilege escalation vector.