Quick Paypal Payments
Quick Paypal Payments creates customizable PayPal payment forms for collecting payments and customer details on WordPress websites.
Quick Paypal Payments (quick-paypal-payments) is a WordPress plugin with 9 published CVE records in this archive. The latest tracked vulnerability was published Oct 16, 2026; the highest published CVSS base score is 7.5.
quick-paypal-paymentsCVE-2026-110017: Quick PayPal Payments: Payment Button & Form: Cross-site scripting
The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content. The export supplies no additional endpoint, action, parameter or function details beyond those described above.
| Safe version |
|
||
|---|---|---|---|
| Oct 16, 2026 |
CVE-2026-110017
Quick PayPal Payments: Payment Button & Form: Cross-site scripting
The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content. The export supplies no additional endpoint, action, parameter or function details beyond those described above.
|
6.0.5 |
CVE6.4
|
| Oct 13, 2026 |
CVE-2026-108492
Quick Paypal Payments: Missing authorization
A request can reach a protected operation without its intended authorization check. The CNA vector requires no authentication and no victim interaction, with limited unauthorized changes to protected data. The export does not identify the endpoint, action, parameter, affected records or operation. A specific account-takeover, payment-manipulation or code-execution chain is not established. Affected versions: <= 6.0.3. The authoritative export identifies 6.0.4 as fixed for this CVE.
|
6.0.4 |
CVE5.3
|
| Aug 12, 2026 |
CVE-2026-17008
Quick Paypal Payments IPN validation permits underpayment
Quick Paypal Payments through 5.7.50 exposes its PayPal IPN listener through qpp_ipn() on the default /?qpp_ipn URL. The listener matched the PayPal custom order token but did not verify the received amount, currency, receiving PayPal account or completed payment status. An unauthenticated buyer could therefore pay an arbitrary small amount and have a full-price order marked paid. Version 5.7.51 adds amount, currency, recipient and payment-status checks plus replay protection.
|
5.7.51 |
CVE5.3
|
| Sep 05, 2025 |
CVE-2025-27003
Quick Paypal Payments: Cross-site request forgery
Quick Paypal Payments is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
|
| Dec 09, 2024 |
CVE-2023-25714
Quick Paypal Payments: A security weakness
Quick Paypal Payments is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
|
| May 02, 2023 |
CVE-2023-1554
Quick Paypal Payments: Cross-site scripting
Quick Paypal Payments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
|
| Apr 25, 2023 |
CVE-2023-23889
Quick Paypal Payments: Cross-site scripting
Quick Paypal Payments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|
| Apr 07, 2023 |
CVE-2023-25713
Quick Paypal Payments: Cross-site scripting
Quick Paypal Payments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
|
| Apr 07, 2023 |
CVE-2023-25702
Quick Paypal Payments: Cross-site scripting
Quick Paypal Payments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
|