PT-2025-46256 · WordPress · Paypal Donation Shortcode

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11859

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Paypal Donation Shortcode plugin for WordPress versions up to and including 0.1

Description The Paypal Donation Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'paypal' shortcode. This occurs because the plugin does not adequately sanitize user input and output for the 'title' and 'text' parameters. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute when a user accesses the compromised page.

Recommendations Update the Paypal Donation Shortcode plugin to a version beyond 0.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11859

Affected Products

Paypal Donation Shortcode

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-11859 · Security Note
• https://plugins.trac.wordpress.org/browser/paypal-donation-shortcode/tags/0.1/paypal-donation-shortcode.php#L23 · Note
• https://twitter.com/CVEnew/status/1988095308127993932 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b66ab7c4-7963-424f-afec-0e52b987c6b3?source=cve · Note