plugin
29 known security issues reported for the Quick Paypal Payments WordPress plugin. Most recent disclosed Aug 5, 2026.
Running Quick Paypal Payments on your site? Check whether your installed version is affected.
Scan your site freeThe Quick Paypal Payments plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 5.7.50. This makes it possible for unauthenticated attackers to bypass payments.
[en] Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments allows Cross Site Request Forgery. This issue affects Quick Paypal Payments: from n/a through 5.7.46.
The Quick Paypal Payments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.46. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a sit...
[en] Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....
This plugin is not fixed. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Quick Paypal Payments Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed...
[en] The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
[en] Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
[en] Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
Update the WordPress Quick Paypal Payments plugin to the latest available version (at least 5.7.26.4). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Quick Paypal Payments Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisement...
The Quick Paypal Payments for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 5.7.26.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arb...
The Quick Paypal Payments for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 5.7.26.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arb...
Update the WordPress Quick Paypal Payments plugin to the latest available version (at least 5.7.22). An unknown person discovered and reported this Sensitive Data Exposure vulnerability in WordPress Quick Paypal Payments Plugin. This vulnerability has been fixed in version 5.7.22.
Update the WordPress Quick Paypal Payments plugin to the latest available version (at least 5.7.22). An unknown person discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Quick Paypal Payments Plugin. This could allow a malicious actor to force higher privileged users to execute un...
The Quick Paypal Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.7.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor l...
The Quick Paypal Payments plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and nonce check on the 'download_logs' function in versions up to, and including, 5.7.25. This allows unauthenticated attackers to export and delete payment messages and modify paymen...
The Quick Paypal Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.7.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...
The Quick Paypal Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings through several parameters (blurb, comboboxword, comboboxlabel, shortcodeamount, postagepercent, postagefixed, couponref, couponbutton, minamount, recurringhowmany, Dperiod, Wperiod, Mperiod, Yperiod, every, q...
The Quick Paypal Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings through several parameters (blurb, comboboxword, comboboxlabel, shortcodeamount, postagepercent, postagefixed, couponref, couponbutton, minamount, recurringhowmany, Dperiod, Wperiod, Mperiod, Yperiod, every, q...
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...
Sensitive Information Disclosure vulnerability discovered in WordPress Quick Paypal Payments plugin (versions < 5.7.22).
Sensitive Information Disclosure vulnerability discovered in WordPress Quick Paypal Payments plugin (versions < 5.7.22).
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. This plugin is not fixed.
The Quick Paypal Payments plugin for WordPress is vulnerable to Cross-Site Scripting via the 'reference' and 'amount' parameters in versions before 3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The Quick Paypal Payments plugin for WordPress is vulnerable to Cross-Site Scripting via the 'reference' and 'amount' parameters in versions before 3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
The Quick Paypal Payments WordPress plugin was affected by a Payment Sending Multiple Parameter XSS security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free