Scott Paterson
Monthly
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated attackers can enumerate and exfiltrate all customer order records from Easy PayPal Events & Tickets plugin for WordPress through an exposed QR code scanning endpoint. The scan_qr.php file accepts sequential WordPress post IDs without authentication, enabling complete database harvesting of payment and customer information. Publicly available exploit code exists, but no evidence of active exploitation (not in CISA KEV). The plugin was officially closed and removed from WordPress.org on 2026-03-18, leaving existing installations vulnerable with no official patch path.
Hardcoded authentication bypass in Easy PayPal Events & Tickets plugin allows unauthenticated remote attackers to retrieve sensitive order data by supplying 'test' as the hash parameter to the QR code scanning endpoint. Attackers can access PayPal transaction IDs, customer emails, purchase amounts, and ticket information for any order by enumerating post IDs. Public exploit code exists on GitHub, significantly lowering the exploitation barrier. The plugin was officially closed by WordPress.org on 2026-03-18, leaving installations vulnerable with no future patches.
Broken access control in Contact Form 7 - PayPal & Stripe Add-on versions 2.5.1 and below allows unauthenticated remote attackers to invoke privileged plugin functionality without authorization, enabling unauthorized modification of plugin state or disruption of payment form behavior. Discovered and disclosed by Patchstack (ENISA EUVD-2026-57898), the flaw is rooted in CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute sensitive actions without verifying caller permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated attackers can enumerate and exfiltrate all customer order records from Easy PayPal Events & Tickets plugin for WordPress through an exposed QR code scanning endpoint. The scan_qr.php file accepts sequential WordPress post IDs without authentication, enabling complete database harvesting of payment and customer information. Publicly available exploit code exists, but no evidence of active exploitation (not in CISA KEV). The plugin was officially closed and removed from WordPress.org on 2026-03-18, leaving existing installations vulnerable with no official patch path.
Hardcoded authentication bypass in Easy PayPal Events & Tickets plugin allows unauthenticated remote attackers to retrieve sensitive order data by supplying 'test' as the hash parameter to the QR code scanning endpoint. Attackers can access PayPal transaction IDs, customer emails, purchase amounts, and ticket information for any order by enumerating post IDs. Public exploit code exists on GitHub, significantly lowering the exploitation barrier. The plugin was officially closed by WordPress.org on 2026-03-18, leaving installations vulnerable with no future patches.
Broken access control in Contact Form 7 - PayPal & Stripe Add-on versions 2.5.1 and below allows unauthenticated remote attackers to invoke privileged plugin functionality without authorization, enabling unauthorized modification of plugin state or disruption of payment form behavior. Discovered and disclosed by Patchstack (ENISA EUVD-2026-57898), the flaw is rooted in CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute sensitive actions without verifying caller permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.