Stored Cross-Site Scripting Vulnerability in Quick PayPal Payments Plugin for WordPress
CVE-2026-110017

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Quick Paypal Payments: Payment Button & Form
Vendor
CVE Published:
16 October 2026

What is CVE-2026-110017?

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'form' parameter in all versions up to and including 6.0.4. This vulnerability arises from insufficient input sanitization and output escaping, enabling authenticated attackers with contributor-level permissions and higher to execute arbitrary scripts in web pages viewed by other users. When these scripts are injected, they're triggered during post previews for all viewers, including privileged roles like Editors and Administrators, ultimately compromising web security.

Affected Version(s)

Quick PayPal Payments: Payment Button & Form 0 <= 6.0.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/quick-paypal-p...
https://plugins.trac.wordpress.org/browser/quick-paypal-p...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.