CVE-2026-110017 in Quick PayPal Payments Payment Button & Form Plugin
Summary
by MITRE • 10/16/2026
The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The Quick PayPal Payments plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within its form handling functionality. This vulnerability exists in all versions up to and including 6.0.4, stemming from insufficient input sanitization and output escaping mechanisms when processing the 'form' parameter. The core technical issue lies in the reliance on wp_kses_post for data validation. While this function is designed to strip dangerous HTML tags such as script or iframe elements, it does not adequately handle quote-breaking payloads that do not contain angle brackets. Consequently, an attacker can craft a malicious payload using attributes like onclick or onload within standard HTML tags that are permitted by the filter, allowing the code to survive the sanitization process intact and persist in the database upon save.
The operational impact of this vulnerability is significant due to its stored nature and low privilege requirement for exploitation. Attackers with contributor-level access or higher can inject arbitrary web scripts into pages managed by the plugin. These injected scripts execute automatically whenever any user accesses a page containing the malicious content. This creates a persistent threat vector where every visitor becomes a potential victim, but it is particularly dangerous because WordPress workflows often involve Editors and Administrators previewing pending content submitted by Contributors before publication. Since these higher-privileged users routinely view this unapproved content to ensure quality and compliance, they inadvertently trigger the execution of the attacker's script in their own browser sessions while logged into the administrative dashboard.
This scenario facilitates a severe compromise of account security through session hijacking or credential theft. Because the malicious code executes within the context of an authenticated administrator or editor, it can access sensitive cookies, including those containing authentication tokens and nonces. An attacker could exploit this to steal these credentials, effectively escalating their privileges from contributor-level to full administrative control over the WordPress installation. This level of access allows for complete site takeover, data exfiltration, defacement, or further lateral movement within the network infrastructure hosting the application. The vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause of cross-site scripting flaws.
From an offensive security perspective, this attack vector maps directly to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within the browser environment. The stored nature of the payload corresponds to persistence mechanisms where malicious code remains active across multiple user sessions without requiring repeated exploitation attempts for each victim. To mitigate this risk, site administrators must immediately update the Quick PayPal Payments plugin to a version newer than 6.0.4 if available, or disable and remove the plugin entirely until an official patch is released. Additionally, implementing strict Content Security Policy headers can help restrict inline script execution, providing a layer of defense in depth against such injection attacks even if input validation fails. Regular security audits focusing on output encoding practices for all user-controlled data inputs are essential to prevent similar vulnerabilities across WordPress ecosystems.