Getpaid
Monthly
Stored cross-site scripting in the GetPaid WordPress invoicing plugin, affecting versions through 2.8.62, allows remote attackers to plant script payloads that execute in the browser of any user who later views the affected page. The CVSS 3.1 score of 7.1 reflects network reachability and no authentication requirement for introducing the payload (PR:N), offset by a required victim interaction (UI:R) and a scope change (S:C) that lets the injected script act beyond the plugin's own context. No public exploit identified at time of analysis.
Sensitive information disclosure in the GetPaid WordPress plugin (also known as Invoicing, by Stiofan) through version 2.8.49 allows remote unauthenticated attackers to retrieve embedded sensitive data via responses sent by the plugin. The flaw is classified as CWE-201 and was reported by Patchstack; no public exploit identified at time of analysis, but the network-reachable, no-auth, no-interaction CVSS profile makes opportunistic discovery plausible on exposed WordPress sites.
Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.8.11. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the GetPaid WordPress invoicing plugin, affecting versions through 2.8.62, allows remote attackers to plant script payloads that execute in the browser of any user who later views the affected page. The CVSS 3.1 score of 7.1 reflects network reachability and no authentication requirement for introducing the payload (PR:N), offset by a required victim interaction (UI:R) and a scope change (S:C) that lets the injected script act beyond the plugin's own context. No public exploit identified at time of analysis.
Sensitive information disclosure in the GetPaid WordPress plugin (also known as Invoicing, by Stiofan) through version 2.8.49 allows remote unauthenticated attackers to retrieve embedded sensitive data via responses sent by the plugin. The flaw is classified as CWE-201 and was reported by Patchstack; no public exploit identified at time of analysis, but the network-reachable, no-auth, no-interaction CVSS profile makes opportunistic discovery plausible on exposed WordPress sites.
Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.8.11. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.