What is the CVSS score of CVE-2026-65517?

CVE-2026-65517 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Easy PayPal Button are affected by CVE-2026-65517?

The Easy PayPal Buy Now Button WordPress plugin version 2.0.4 and earlier contains an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious code into websites…

How to fix or mitigate CVE-2026-65517?

Within 24 hours: Inventory all WordPress installations to identify current versions of the Easy PayPal Buy Now Button plugin; immediately disable and remove the plugin from any instance running version 2.0.4 or earlier, or deactivate the plugin as an emergency interim measure if removal is not feasible. Within 7 days: Implement Web Application Firewall (WAF) rules to block script injection payloads targeting the affected plugin parameters as a compensating control; review access logs and website analytics for signs of prior exploitation (unusual JavaScript execution, unauthorized admin accounts, malformed requests to the plugin). Within 30 days: Monitor vendor advisory channels and GitHub security updates for a patched version; evaluate and deploy an alternative PayPal integration solution that does not rely on this abandoned or vulnerable plugin; conduct a full security audit of affected WordPress sites for evidence of compromise during the exposure window.

Easy PayPal Button CVE-2026-65517

EUVD-2026-53968 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-mf68-4qg5-vfv6

WordPress XSS Wordpress Plugin Easy Paypal Buy Now Button Scott Paterson

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Standard unauthenticated XSS with browser scope change; A:N assigned because XSS does not typically cause measurable availability impact on the server or client beyond content manipulation.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:29 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The affected product is the Easy PayPal Buy Now Button WordPress plugin by Scott Paterson, precisely identified via CPE cpe:2.3:a:scott_paterson:easy_paypal_buy_now_button:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning the plugin fails to adequately sanitize or escape user-controlled input before rendering it as part of HTML output. The scope-changed (S:C) CVSS metric confirms the injected script executes in the victim's browser trust boundary rather than the plugin's own - consistent with reflected or stored XSS patterns common in WordPress plugins that embed request parameters or database-stored values directly into page output without proper encoding. The plugin slug (wp-ecommerce-paypal) is a PayPal payment integration widget for WordPress, suggesting the vulnerable input likely exists within button configuration rendering or shortcode output paths.

RemediationAI

The primary remediation is to update the Easy PayPal Buy Now Button plugin to a version beyond 2.0.4; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-ecommerce-paypal/vulnerability/wordpress-easy-paypal-buy-now-button-plugin-2-0-4-cross-site-scripting-xss-vulnerability and the official WordPress plugin repository for the confirmed patched release - an exact fixed version number is not present in the available intelligence and must be verified before deployment. If an immediate update is not possible, deactivating the plugin entirely eliminates the attack surface with no server-side risk, at the cost of losing PayPal buy-button functionality site-wide. A Web Application Firewall rule targeting common XSS patterns in plugin-related HTTP parameters provides partial coverage but is not a substitute for patching, as WAF bypass techniques for XSS are well-documented. Restricting access to pages that render the plugin's output to authenticated users only (if operationally feasible) would raise the attacker bar from unauthenticated to authenticated injection, reducing exposure while preserving functionality.