Stored Cross-Site Scripting in GetPaid Plugin for WordPress

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping. Specifically, the 'mmdwqzpoxadd' parameter fails to properly filter user-supplied input, allowing unauthenticated attackers to inject malicious web scripts. The vulnerability is exacerbated by the plugin's insecure handling of the 'getpaid_form_nonce' value, which is exposed to all visitors through 'wp_localize_script' as 'WPInv.formNonce'. Consequently, an attacker does not require authentication or separate authorization tokens to carry out the injection. The injected payload executes within the context of an administrator's session whenever they view the Payment Form Details metabox for a compromised invoice. This flaw affects all plugin versions up to and including 2.8.61.

Impact

Successful exploitation allows unauthenticated attackers to perform actions within the administrative context of the WordPress instance. This may lead to unauthorized modification of settings, elevation of privileges, or the theft of administrative session cookies, depending on the capabilities of the injected payload.

Recommendation

Prioritized actions for security teams:

• Update the GetPaid plugin to a version beyond 2.8.61 immediately.
• Audit the WordPress environment for unauthorized plugin configurations or unusual activity in administrative payment form management.
• Review web server access logs for POST requests containing script-like structures in the 'mmdwqzpoxadd' parameter.