CVE-2026-111110 in GetPaid Plugin
Summary
by MITRE • 10/17/2026
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The GetPaid plugin for WordPress, which facilitates payment forms, buy now buttons, and invoicing systems, contains a critical security vulnerability affecting all versions up to 2.8.61. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue located within the mmdwqzpoxadd parameter. The root cause of this vulnerability lies in insufficient input sanitization and output escaping mechanisms during the processing of user-supplied data. Because the application fails to properly validate or encode inputs before storage, malicious actors can inject arbitrary web scripts into the database. These scripts are then persistently stored on the server-side rather than being executed immediately upon submission, which distinguishes this as a stored XSS vulnerability rather than a reflected one.
The operational impact of this flaw is severe due to the specific authentication requirements and nonce handling within the plugin's architecture. Typically, WordPress plugins require nonces for security to prevent Cross-Site Request Forgery attacks. However, in this case, the required getpaid_form_nonce is publicly emitted to all visitors through wp_localize_script as WPInv.formNonce. This design decision effectively neutralizes any authentication barrier that might have otherwise protected sensitive administrative functions. Consequently, unauthenticated attackers can craft requests with valid nonces without needing prior access or a nonce leak. When an administrator views the Payment Form Details metabox for an affected invoice, the stored malicious script is rendered and executed in their browser context.
This execution occurs within the security context of the logged-in administrator, granting the attacker elevated privileges equivalent to that user role. The consequences can include session hijacking, where the attacker steals administrative cookies to gain full control over the WordPress installation; defacement of the website by injecting malicious content into pages viewed by other users; or redirection of traffic to phishing sites designed to steal credentials from visitors. Furthermore, attackers may deploy keyloggers or malware downloads that execute silently in the background while the administrator is managing invoices and payment forms.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. Specifically, it falls under Stored XSS where malicious scripts are permanently stored within target servers such as databases or message boards. In terms of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1059: Command and Scripting Interpreter, particularly JavaScript execution in a browser environment, and potentially T1204: User Execution if it leads to further social engineering attacks against site visitors. The lack of proper output encoding also relates to CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.
To mitigate this vulnerability, administrators must immediately update the GetPaid plugin to version 2.8.62 or later where these sanitization and escaping issues have been addressed by the developers. Until an update is available, it is advisable to restrict access to WordPress admin areas using IP whitelisting if possible, although this does not fully mitigate stored XSS once a payload is injected. Implementing a Web Application Firewall can help detect and block attempts to inject malicious scripts into form parameters. Additionally, reviewing recent invoices for any anomalous content in the payment forms or invoice details may reveal active exploitation attempts. Developers should ensure that all user inputs are strictly validated against expected formats and that outputs are properly encoded using functions like wp_kses_post or esc_html before rendering them in HTML contexts to prevent script execution.