Quick PayPal Payments CVE-2026-110017

Exploitation requires an authenticated WordPress account with Contributor-level privileges or higher on a site running Quick PayPal Payments ≤6.0.4, and the attacker must submit a payload through the plugin's 'form' parameter. The payload must be quote-breaking and contain no angle brackets to survive the wp_kses_post filter. Successful impact against privileged users additionally depends on an Editor or Administrator viewing/previewing the attacker's injected post - a routine moderation action for pending Contributor content, but still a dependency. The primary limiting factor is the Contributor authentication requirement: sites that do not allow untrusted users to register as Contributors are not practically exposed.

This is a moderate-severity stored XSS (CVSS 6.4) that reflects a genuine but constrained risk rather than a critical priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-reachable, low-complexity exploitation, but PR:L is the decisive limiter: an attacker must already hold an authenticated Contributor-or-above account, which means this is not an unauthenticated internet-wide threat. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - no public exploit identified at time of analysis. The notable amplifying factor, well-supported by the description, is the privilege-escalation pathway: because wp_kses_post strips only angle-bracket tags, a quote-breaking payload survives post save, and the script executes when higher-privileged Editors or Administrators preview a Contributor's pending content, enabling potential account/session takeover despite the modest C:L/I:L rating. Net assessment: patch in normal cycle for sites that permit untrusted Contributor registrations; lower urgency for sites where all content authors are trusted.

An attacker registers or obtains a Contributor account on a target WordPress site and creates a draft post embedding a quote-breaking JavaScript payload via the plugin's vulnerable 'form' parameter, which bypasses wp_kses_post because it contains no angle brackets. When an Editor or Administrator previews the pending post for moderation, the stored script executes in their authenticated browser session. No public exploit code was identified, though the low attack complexity (AC:L) makes manual exploitation straightforward.