PT-2026-39522 · WordPress · Getpaid Plugin

Niraj Mahajan · Published 2026-05-10 · Updated 2026-05-10 · CVE-2021-47948

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GetPaid Plugin version 2.4.6

Description An HTML injection issue allows authenticated attackers to inject arbitrary HTML code, including image tags and scripts, by exploiting the Help Text field in payment forms. The injected code is stored in the database and executed in the browser when the form is viewed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2021-47948

Affected Products

Getpaid Plugin

References · 5

• 🔥 https://exploit-db.com/exploits/50246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47948 · Security Note
• https://vulncheck.com/advisories/wordpress-getpaid-plugin-html-injection-via-help-text · Note
• https://wordpress.org/plugins/invoicing · Note
• https://twitter.com/CVEnew/status/2053537418029260951 · Twitter Post