Quick Paypal Payments
Monthly
Stored cross-site scripting in the Quick PayPal Payments: Payment Button & Form WordPress plugin (all versions up to and including 6.0.4) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript through the plugin's 'form' parameter, which then executes for every viewer of the affected post. The sanitization bypass is notable because the payload survives wp_kses_post by using a quote-breaking, angle-bracket-free construction, so injected script fires even for Editors and Administrators who routinely preview a Contributor's pending content. No public exploit code has been identified at time of analysis, and this is a moderate-severity (CVSS 6.4) issue whose practical exposure depends on whether a site permits untrusted users to register or be assigned the Contributor role.
An unauthenticated remote attacker can invoke access-controlled functionality in the Fullworks Plugins Quick Paypal Payments WordPress plugin (versions through 6.0.3) because the plugin does not enforce the authorization checks that gate those code paths. Successful exploitation yields a bounded Low integrity impact - an attacker can reach and manipulate plugin/payment-related data but cannot read confidential data or affect availability through this issue alone, which is why this is a moderate-risk, not high-priority, issue per our assessment. No public exploit code was identified at time of analysis and the plugin has no CISA KEV listing, but the endpoint is trivially reachable over the network with no credentials or user interaction required, and no vendor-released fixed version is confirmed in the available data.
Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in the Quick PayPal Payments: Payment Button & Form WordPress plugin (all versions up to and including 6.0.4) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript through the plugin's 'form' parameter, which then executes for every viewer of the affected post. The sanitization bypass is notable because the payload survives wp_kses_post by using a quote-breaking, angle-bracket-free construction, so injected script fires even for Editors and Administrators who routinely preview a Contributor's pending content. No public exploit code has been identified at time of analysis, and this is a moderate-severity (CVSS 6.4) issue whose practical exposure depends on whether a site permits untrusted users to register or be assigned the Contributor role.
An unauthenticated remote attacker can invoke access-controlled functionality in the Fullworks Plugins Quick Paypal Payments WordPress plugin (versions through 6.0.3) because the plugin does not enforce the authorization checks that gate those code paths. Successful exploitation yields a bounded Low integrity impact - an attacker can reach and manipulate plugin/payment-related data but cannot read confidential data or affect availability through this issue alone, which is why this is a moderate-risk, not high-priority, issue per our assessment. No public exploit code was identified at time of analysis and the plugin has no CISA KEV listing, but the endpoint is trivially reachable over the network with no credentials or user interaction required, and no vendor-released fixed version is confirmed in the available data.
Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.