Checkout For Paypal Vulnerabilities

The Checkout for PayPal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.46. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.0.46

Fixed in:

1.0.47

Disclosed:

Feb 19, 2026

CVE-2026-32387 on NVD →

The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p...

CVSS:

6.4

Affected:

up to 1.0.38

Fixed in:

1.0.39

Disclosed:

Apr 16, 2025

CVE-2025-39572 on NVD →

The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

CVSS:

6.4

Affected:

up to 1.0.32

Fixed in:

1.0.33

Disclosed:

Jan 16, 2025

CVE-2024-13398 on NVD →

The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes ('item_description' and 'amount') within the ‘checkout_for_paypal_button_handler’ function in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible...

CVSS:

6.4

Affected:

up to 1.0.13

Fixed in:

1.0.14

Disclosed:

Nov 22, 2022

CVE-2022-3983 on NVD →