GetPaid CVE-2026-115609

Exploitation requires that an attacker can submit data into a GetPaid (invoicing plugin) input that is stored and later rendered without proper output neutralization; per the CVSS vector (PR:N) no authentication is required to introduce the payload, but execution depends on a victim subsequently viewing the page containing it (UI:R), which is the primary limiting factor. Affected deployments are GetPaid versions up to and including 2.8.62. The exact field, form, or admin view that stores and reflects the payload is not described in the available sources, so the concrete trigger cannot be confirmed from the supplied data.

This is a moderate-severity stored XSS (CVSS 7.1) whose network vector (AV:N), low attack complexity (AC:L), and no-privilege requirement (PR:N) are offset by a required user-interaction step (UI:R) - a victim must load the page where the payload renders. The scope-changed, low-triple impact (S:C, C:L/I:L/A:L) reflects script execution in a victim's browser session rather than direct server compromise. No EPSS score, no CISA KEV listing, and no PoC/exploit reference beyond the Patchstack advisory were supplied, so there is no public exploit identified at time of analysis and no quantitative exploitation-probability signal to weigh. The vuln.today decision label is 'this_week', indicating a near-term but not emergency priority. Net: a credible, real stored-XSS issue worth patching on a short timeline, but not a mass-exploitation emergency - the absence of KEV/EPSS/PoC signals points to standard remediation rather than active, widespread attack. Note the signals are thin: only a single Patchstack reference underpins this assessment.

An attacker places a malicious script into a GetPaid input field that the plugin fails to neutralize, and the payload is stored. When an administrator or another user later views the page that renders this data, the script executes in their browser session, enabling session/cookie theft or actions in their authenticated context. No public exploit code was identified; the exact injectable field is not described in the available sources.