Stored Cross-Site Scripting Vulnerability in Paicoding Payment Notifications

CVE-2026-129142

What is CVE-2026-129142?

The Paicoding payment notifications system contains a vulnerability where unescaped user input, specifically the payer's display name, is rendered in the user notification interface. This flaw allows authenticated attackers to manipulate their display name to include malicious scripts. Once a pending payment is initiated by the attacker, any subsequent viewing of notifications by the author may lead to script execution in their browser, potentially compromising user data and overall security. Developers and users of Paicoding are advised to review this issue and apply necessary patches to prevent exploitation.

References