CVE-2026-110017

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-110017 Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-102659

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-110017

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.0.4 . The root cause is insufficient input sanitization and output escaping within the 'form' parameter of a shortcode attribute. An authe...

PT-2026-115455

Name of the Vulnerable Software and Affected Versions Quick PayPal Payments: Payment Button & Form versions prior to 6.0.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can...

CVE-2026-110017: Improper Neutralization of Input During Web Page Generation

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

WordPress Quick PayPal Payments: Payment Button & Form plugin <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Quick Paypal Payments versions = 6.0.4...

CVE-2026-94179

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...

CVE-2026-94179 WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...

CVE-2026-94179

The Razorpay Payment Button WordPress plugin versions

EUVD-2026-85476

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...

CVE-2026-94179 WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...

WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button versions = 2.4.9...

PT-2026-97461

Name of the Vulnerable Software and Affected Versions Razorpay Payment Button versions prior to 2.5.0 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user. Recommendations Update Razorpay Payment Butto...

CVE-2026-94179: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...

WordPress Payment Button for PayPal plugin <= 1.2.3.44 - Unauthenticated Payment Price Manipulation vulnerability

Unauthenticated Payment Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Button for PayPal versions = 1.2.3.44...

CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990 Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

EUVD-2026-57175

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990

The CVE concerns the WordPress plugin “Payment Button for PayPal” (versions up to 1.2.3.44). The root cause is that the plugin does not enforce the merchant-configured price server-side and trusts the amount provided by the client, enabling unauthenticated attackers to create a real PayPal order ...