PT-2026-26861 · WordPress · Paypal Shortcodes
Published
2026-03-21
·
Updated
2026-03-21
·
CVE-2026-3617
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Paypal Shortcode plugin for WordPress versions up to and including 0.3
Description
The Paypal Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'amount' and 'name' shortcode attributes. This is a result of inadequate input sanitization and output escaping of user-provided shortcode attributes. The
swer paypal shortcode() function retrieves shortcode attributes using extract() and shortcode atts() and then directly incorporates the name and amount values into HTML input element value attributes without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages, which will execute when a user accesses the affected page. The vulnerable parameters are amount and name.Recommendations
Update the Paypal Shortcode plugin to a version beyond 0.3.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Paypal Shortcodes