{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agetpaidgetpaidwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getpaid:getpaid:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-111110"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GetPaid (\u003c= 2.8.61)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping. Specifically, the 'mmdwqzpoxadd' parameter fails to properly filter user-supplied input, allowing unauthenticated attackers to inject malicious web scripts. The vulnerability is exacerbated by the plugin's insecure handling of the 'getpaid_form_nonce' value, which is exposed to all visitors through 'wp_localize_script' as 'WPInv.formNonce'. Consequently, an attacker does not require authentication or separate authorization tokens to carry out the injection. The injected payload executes within the context of an administrator's session whenever they view the Payment Form Details metabox for a compromised invoice. This flaw affects all plugin versions up to and including 2.8.61.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform actions within the administrative context of the WordPress instance. This may lead to unauthorized modification of settings, elevation of privileges, or the theft of administrative session cookies, depending on the capabilities of the injected payload.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the GetPaid plugin to a version beyond 2.8.61 immediately.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress environment for unauthorized plugin configurations or unusual activity in administrative payment form management.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for POST requests containing script-like structures in the 'mmdwqzpoxadd' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T08:49:18Z","date_published":"2026-10-17T08:49:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-getpaid-xss/","summary":"The GetPaid plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the mmdwqzpoxadd parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser.","title":"Stored Cross-Site Scripting in GetPaid Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-10-getpaid-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:getpaid:getpaid:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}