EUVD-2026-14172
GHSA-p79j-x7g4-4j32
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the PayPal Shortcodes WordPress plugin affecting all versions up to and including 0.3. The plugin fails to properly sanitize and escape the 'amount' and 'name' shortcode attributes, allowing authenticated attackers with Contributor-level access or higher to inject malicious JavaScript that executes for all users viewing affected pages. With a CVSS score of 6.4 and network-based attack vector, this represents a moderate-severity threat to WordPress installations using this plugin, particularly those with multiple contributor accounts.
Technical ContextAI
The vulnerability exists in the swer_paypal_shortcode() function within the PayPal Shortcodes plugin (CPE: cpe:2.3:a:swergroup:paypal_shortcodes). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable code path begins at line 89 where shortcode attributes are extracted using WordPress's extract() and shortcode_atts() functions, which parse user-supplied shortcode parameters. These unsanitized values are then directly concatenated into HTML input element value attributes at lines 105-106 without applying WordPress's esc_attr() escaping function or any equivalent output encoding mechanism. This violation of secure coding practices for WordPress plugin development allows untrusted data to flow directly into the DOM, creating an injection point for arbitrary HTML and JavaScript.
RemediationAI
Users should immediately update the PayPal Shortcodes plugin to the latest available version beyond 0.3, which should include patches applying esc_attr() escaping to the 'amount' and 'name' shortcode attributes at lines 105-106. Consult the official WordPress plugin repository and Wordfence threat advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e) for the patched version number and update instructions. Until a patched version is available or deployed, administrators should: restrict Contributor-level permissions to trusted users only, audit existing posts and pages for suspicious shortcode content using the plugin repository audit trail, and consider disabling the plugin if not actively in use. For WordPress multisite installations, use the Network Admin to enforce plugin updates across all sites simultaneously. If the plugin is abandoned, consider replacing it with an actively maintained PayPal integration solution.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today