Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Paypal Shortcode Plugin for WordPress Allows Malicious Script Injection

CVE-2026-3617
Summary

The Paypal Shortcode plugin for WordPress can be exploited by authenticated users with Contributor-level access to inject malicious scripts on certain pages, potentially affecting the security of your site. To protect your site, update the plugin to a version that fixes this issue or consider replacing it with a more secure alternative.

Original title
The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to ins...
Original description
The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
nvd CVSS3.1 6.4
Vulnerability type
CWE-79 Cross-site Scripting (XSS)
Published: 21 Mar 2026 · Updated: 21 Mar 2026 · First seen: 21 Mar 2026