81 matches found
CVE-2026-115609
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62...
CVE-2026-115609
The Stiofan GetPaid invoicing plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.8.62 . The flaw stems from the improper neutralization of input during web page generation , which allows an attacker to inject malicious scripts...
CVE-2026-115609 WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62...
EUVD-2026-112061
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62...
PT-2026-128239
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62...
WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin GetPaid versions = 2.8.62...
CVE-2026-111110
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-111110
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress (versions up to and including 2.8.61 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'mmdwqzpoxa...
CVE-2026-111110 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-103275
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-111110 Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin GetPaid versions = 2.8.61...
PT-2026-116383
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-111110: Improper Neutralization of Input During Web Page Generation
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress GetPaid Cross-site Scripting Vulnerability
WordPress GetPaid versions 2.8.61 and earlier have a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting attack conducted through the 'mmdwqzpoxadd' parameter. Due to insufficient input sanitization and output escaping, unauthenticated attackers...
WordPress GetPaid plugin < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification vulnerability
Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification vulnerability discovered by Pedro Pinho in WordPress Plugin GetPaid versions 2.8.55...
EUVD-2026-54190
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-12901
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-12901
The CVE-2026-12901 entry concerns the GetPaid WordPress plugin (versions prior to 2.8.55). The vulnerability arises because Worldpay payment notifications are not authenticated, enabling unauthenticated attackers to forge a notification that marks a pending invoice as paid without real payment. I...