{
 "id": "WPSEC-2026-1047",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1047/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1047/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1047/index.md",
 "title": "Pay For Post with WooCommerce <= 3.2.34 - Unauthenticated Reflected Cross-Site Scripting via Pricing Page URL Parameters",
 "description": "The Pay For Post with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting and pricing configuration injection via URL parameters on the bundled Freemius SDK pricing page in all versions up to, and including, 3.2.34. This is due to arbitrary GET parameters being merged over trusted pricing app configuration values (such as contact_url, fs_wp_endpoint_url, request_handler_url and plugin_icon) without validation. This makes it possible for unauthenticated attackers to make the pricing page's links and requests point to attacker-controlled locations, including javascript: URLs that run arbitrary script in the administrator's session when clicked. The attacker has to trick a site administrator into opening a crafted link and interacting with the page.",
 "plugin": {
  "slug": "woocommerce-pay-per-post",
  "name": "Pay For Post with WooCommerce",
  "full_name": "Pay For Post with WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-pay-per-post/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-pay-per-post/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-pay-per-post"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.35",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.35"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.35",
 "remediation": "Update to 3.2.35 or later.",
 "fix_released": "2026-10-15T03:17:15+00:00",
 "published": "2026-10-16T03:40:56+00:00",
 "updated": "2026-10-15T08:16:06.238306+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1047/",
  "https://plugins.svn.wordpress.org/woocommerce-pay-per-post/tags/3.2.35/",
  "https://wordpress.org/plugins/woocommerce-pay-per-post/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-pay-per-post",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}