What is the CVSS score of CVE-2026-3617?

CVE-2026-3617 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3617?

Organizations using all should be aware of moderate risk from CVE-2026-3617, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-3617?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3617

EUVD-2026-14172 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-p79j-x7g4-4j32

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14172

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the PayPal Shortcodes WordPress plugin affecting all versions up to and including 0.3. The plugin fails to properly sanitize and escape the 'amount' and 'name' shortcode attributes, allowing authenticated attackers with Contributor-level access or higher to inject malicious JavaScript that executes for all users viewing affected pages. With a CVSS score of 6.4 and network-based attack vector, this represents a moderate-severity threat to WordPress installations using this plugin, particularly those with multiple contributor accounts.

Technical ContextAI

The vulnerability exists in the swer_paypal_shortcode() function within the PayPal Shortcodes plugin (CPE: cpe:2.3:a:swergroup:paypal_shortcodes). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable code path begins at line 89 where shortcode attributes are extracted using WordPress's extract() and shortcode_atts() functions, which parse user-supplied shortcode parameters. These unsanitized values are then directly concatenated into HTML input element value attributes at lines 105-106 without applying WordPress's esc_attr() escaping function or any equivalent output encoding mechanism. This violation of secure coding practices for WordPress plugin development allows untrusted data to flow directly into the DOM, creating an injection point for arbitrary HTML and JavaScript.

RemediationAI

Users should immediately update the PayPal Shortcodes plugin to the latest available version beyond 0.3, which should include patches applying esc_attr() escaping to the 'amount' and 'name' shortcode attributes at lines 105-106. Consult the official WordPress plugin repository and Wordfence threat advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e) for the patched version number and update instructions. Until a patched version is available or deployed, administrators should: restrict Contributor-level permissions to trusted users only, audit existing posts and pages for suspicious shortcode content using the plugin repository audit trail, and consider disabling the plugin if not actively in use. For WordPress multisite installations, use the Network Admin to enforce plugin updates across all sites simultaneously. If the plugin is abandoned, consider replacing it with an actively maintained PayPal integration solution.