Stored Cross-Site Scripting Vulnerability in GetPaid Plugin for WordPress

CVE-2026-111110

What is CVE-2026-111110?

The GetPaid plugin for WordPress is susceptible to a stored cross-site scripting flaw through the 'mmdwqzpoxadd' parameter, impacting all versions up to 2.8.61. This vulnerability stems from inadequate input sanitization and output escaping, enabling attackers to inject arbitrary web scripts. Any script embedded in the affected payment form can execute whenever a user accesses the compromised page. Additionally, the nonce required for form actions (getpaid_form_nonce) is exposed to visitors via wp_localize_script, eliminating the need for authentication. Consequently, when an administrator views the payment form details from an affected invoice, the stored payload can trigger, posing significant security risks.

References