PT-2026-68642

Name of the Vulnerable Software and Affected Versions GetPaid WordPress plugin versions prior to 2.8.55 Description The plugin fails to verify the authenticity of incoming Worldpay payment notifications. This allows unauthenticated attackers to forge notifications that mark pending invoices as pa...

CVE-2021-24369

In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site...