What is the CVSS score of CVE-2026-65518?

CVE-2026-65518 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Accept Donations PayPal Stripe CVE-2026-65518

EUVD-2026-48121 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-cjv7-q42w-f6c6

WordPress XSS Wordpress Plugin Accept Donations With Paypal Stripe Scott Paterson

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L for required contributor account; UI:R for admin interaction; S:C for cross-privilege impact; A:N as XSS alone does not cause availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:14 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

AnalysisAI

Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The affected product is the WordPress plugin 'Accept Donations with PayPal & Stripe' by developer Scott Paterson, identified via CPE cpe:2.3:a:scott_paterson:accept_donations_with_paypal_&_stripe:*:*:*:*:*:*:*:*. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to sanitize or encode user-supplied input before rendering it in the browser. The 'Contributor' framing in the CVE title strongly indicates this is a stored XSS variant: a contributor-level WordPress user (who can create but not publish content) can embed unsanitized script payloads in donation-related fields or post content managed by the plugin, which then execute when rendered in the context of an admin or editor's browser session.

RemediationAI

Upstream fix availability has not been independently confirmed from the input data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/easy-paypal-donation/vulnerability/wordpress-accept-donations-with-paypal-stripe-plugin-1-5-5-cross-site-scripting-xss-vulnerability should be checked for a patched release version. If a patched version is available, update the plugin immediately via the WordPress dashboard or WP-CLI. As a compensating control pending a patch, restrict Contributor-level role assignment to only fully trusted users, since the vulnerability requires that role to exploit. Additionally, deploying a Web Application Firewall (WAF) rule to block reflected or stored script injection in plugin input fields can reduce exploitation likelihood, though this may interfere with legitimate rich-text donation form content. WordPress site owners should also enable Content-Security-Policy headers to limit the damage of any successful XSS execution.