CVE-2025-47623: Easy PayPal Buy Now Button: Stored Malware Injection

Summary

The Easy PayPal Buy Now Button plugin allows hackers to inject malicious code into websites, which can steal user data or take control of the site. This means that if a hacker exploits this vulnerability, they could potentially steal sensitive information or take your website offline. To protect your site, update the Easy PayPal Buy Now Button plugin to the latest version.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
wpplugin	easy_paypal_\&_stripe_buy_now_button	<= 2.0 `cpe:2.3:a:wpplugin:easy_paypal_\&_stripe_buy_now_button::::::wordpress::*`

Original title

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button allows Stored XSS. This issue affects Easy PayPal Buy...

Original description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button allows Stored XSS. This issue affects Easy PayPal Buy Now Button: from n/a through 2.0.

nvd CVSS3.1 4.8

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://patchstack.com/database/wordpress/plugin/wp-ecommerce-paypal/vulnerabili... Third Party Advisory