# Pay For Post with WooCommerce <= 3.2.34 - Unauthenticated Reflected Cross-Site Scripting via Pricing Page URL Parameters

- **ID:** WPSEC-2026-1047
- **Plugin:** Pay For Post with WooCommerce (`woocommerce-pay-per-post`), https://wordpress.org/plugins/woocommerce-pay-per-post/
- **Affected versions:** all versions before 3.2.35
- **Fixed in:** 3.2.35 (Update to 3.2.35 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-pay-per-post
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1047/

## Description

The Pay For Post with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting and pricing configuration injection via URL parameters on the bundled Freemius SDK pricing page in all versions up to, and including, 3.2.34. This is due to arbitrary GET parameters being merged over trusted pricing app configuration values (such as contact_url, fs_wp_endpoint_url, request_handler_url and plugin_icon) without validation. This makes it possible for unauthenticated attackers to make the pricing page's links and requests point to attacker-controlled locations, including javascript: URLs that run arbitrary script in the administrator's session when clicked. The attacker has to trick a site administrator into opening a crafted link and interacting with the page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1047/
- https://plugins.svn.wordpress.org/woocommerce-pay-per-post/tags/3.2.35/
- https://wordpress.org/plugins/woocommerce-pay-per-post/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1047/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.