Wp Ecommerce Paypal Vulnerabilities

The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wh...

CVSS:

7.2

Affected:

up to 2.0.4

Fixed in:

2.0.5

Disclosed:

Jul 28, 2026

CVE-2026-65517 on NVD →

The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web script...

CVSS:

4.4

Affected:

up to 2.0

Fixed in:

2.0.1

Disclosed:

May 7, 2025

CVE-2025-47623 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button allows Stored XSS. This issue affects Easy PayPal Buy Now Button: from n/a through 2.0.

Affected:

up to 2.0

Fix:

No patched version reported

Disclosed:

May 7, 2025

CVE-2025-47623 on NVD →

[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.

Affected:

up to 1.9.1

Fixed in:

1.9.1

Disclosed:

Aug 19, 2024

CVE-2024-43236 on NVD →

The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.9. This is due to insufficient validation on the redirect url supplied via the 'rf' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicio...

CVSS:

7.2

Affected:

up to 1.9

Fixed in:

1.9.1

Disclosed:

Aug 9, 2024

CVE-2024-43236 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.

Affected:

up to 1.8.2

Fixed in:

1.8.2

Disclosed:

Feb 28, 2024

CVE-2023-51683 on NVD →

[en] The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_conne...

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Feb 28, 2024

CVE-2024-1719 on NVD →

The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_co...

CVSS:

4.3

Affected:

up to 1.8.3

Fixed in:

1.9

Disclosed:

Feb 27, 2024

CVE-2024-1719 on NVD →

The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted...

CVSS:

4.3

Affected:

up to 1.8.1

Fixed in:

1.8.2

Disclosed:

Dec 27, 2023

CVE-2023-51683 on NVD →

[en] The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 1.7.4

Fixed in:

1.7.4

Disclosed:

Feb 13, 2023

CVE-2022-4628 on NVD →

The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor...

CVSS:

6.4

Affected:

up to 1.7.3

Fixed in:

1.7.4

Disclosed:

Jan 19, 2023

CVE-2022-4628 on NVD →

Update the WordPress Easy PayPal Buy Now Button plugin to the latest available version (at least 1.7.3). WPScanTeam discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Easy PayPal Buy Now Button Plugin. This could allow a malicious actor to force higher privileged users to execute...

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jan 19, 2023

The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the wpecpp_settingsoptions function. This makes it possible for unauthenticated attackers to inject mal...

CVSS:

5.4

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jun 12, 2017

The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the wpecpp_settingsoptions function. This makes it possible for unauthenticated attackers to inject mal...

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jun 12, 2017

The plugin does not have CSRF check in place when saving its settings, and does not sanitise as well as escape them when output in the page. As a result, an attacker could make a logged in admin change them via. CSRF attack and perform Cross-Site Scripting attacks. The plugin also fixed a Reflected XSS in web browse...

Affected:

up to 1.7.3

Fixed in:

1.7.3