PT-2025-30113 · WordPress · Avishi Wp Paypal Payment Button

Johannes Skamletz + 1 · Published 2025-07-19 · Updated 2025-07-19 · CVE-2025-7669

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avishi WP PayPal Payment Button versions prior to 2.1

Description The Avishi WP PayPal Payment Button plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the /avishi-wp-paypal-payment-button/index.php page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update Avishi WP PayPal Payment Button to version 2.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-7669

Affected Products

Avishi Wp Paypal Payment Button

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-7669 · Security Note
• https://twitter.com/VulmonFeeds/status/1946411194966823053 · Twitter Post
• https://t.me/cvetracker/28192 · Telegram Post
• https://plugins.trac.wordpress.org/browser/avishi-wp-paypal-payment-button/trunk/index.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8416b394-28ae-41de-8784-2ae39f4d201f?source=cve · Note
• https://wordpress.org/plugins/avishi-wp-paypal-payment-button · Note
• https://twitter.com/CVEnew/status/1946418681212231702 · Twitter Post