GetPaid WordPress Plugin EUVD-2026-103275

An unauthenticated attacker reuses the publicly emitted getpaid_form_nonce (exposed to all visitors as WPInv.formNonce via wp_localize_script) to submit a payment form with a malicious 'mmdwqzpoxadd' parameter, which is stored without sufficient sanitization/output escaping on GetPaid versions up to and including 2.8.61. The key limiting factor is that the stored payload only executes when a logged-in administrator opens the specific affected invoice's Payment Form Details metabox in wp-admin, so exploitation requires that privileged victim interaction plus a vulnerable (≤2.8.61) install of the plugin being active.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score of 7.2 is driven largely by the scope change (S:C) combined with PR:N/UI:N; the unauthenticated vector (PR:N) is credibly supported because the description states the required getpaid_form_nonce is publicly emitted to all visitors via wp_localize_script (WPInv.formNonce), removing the usual nonce barrier. However, the input CVSS vector asserts UI:N while the description explicitly states the payload only fires 'when an administrator views the affected invoice's Payment Form Details metabox' - that is administrator interaction, so UI:N understates the real trigger requirement and modestly inflates the score (verify intended UI metric with Wordfence). On the enrichment signals: no CISA KEV entry is present (no active-exploitation signal), no public exploit (POC) is referenced, and no EPSS probability is supplied - so all three exploitation-likelihood signals are either negative or absent. The SSVC-style read is low automatability and partial technical impact: exploitation depends on a privileged victim opening a specific admin screen, which makes this better suited to targeted attacks against a known WordPress admin than to opportunistic mass exploitation. Net: a legitimate stored-XSS admin-takeover vector worth patching promptly, but absent KEV/POC/EPSS it does not rise to emergency status.

An unauthenticated attacker grabs the publicly exposed WPInv.formNonce and submits a crafted payment form where the 'mmdwqzpoxadd' parameter contains a malicious script, which is stored against the invoice. When a site administrator later opens that invoice's Payment Form Details metabox in wp-admin, the script executes in their authenticated session, enabling actions such as admin account or site takeover. No public exploit code was identified at time of analysis, and successful execution depends on an administrator viewing the affected invoice.