{
 "id": "WPSEC-2026-1103",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1103/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1103/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1103/index.md",
 "title": "Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Unauthenticated Reflected Cross-Site Scripting via 'form' Parameter",
 "description": "The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form' URL parameter in versions 5.7.51 up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. On a page with a [qpp] shortcode that names no form, the parameter's value was passed only through sanitize_text_field, which keeps quotes, and was then written into an inline script. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "quick-paypal-payments",
  "name": "Quick PayPal Payments: Payment Button & Form",
  "full_name": "Quick PayPal Payments: Payment Button & Form",
  "wordpress_org": "https://wordpress.org/plugins/quick-paypal-payments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quick-paypal-payments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quick-paypal-payments"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.7.51",
    "from_inclusive": true,
    "to": "6.0.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.7.51 before 6.0.5"
  ]
 },
 "introduced_in": "5.7.51",
 "fixed_in": "6.0.5",
 "remediation": "Update to 6.0.5 or later.",
 "fix_released": "2026-10-14T13:45:18+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T11:28:02.031830+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1103/",
  "https://plugins.svn.wordpress.org/quick-paypal-payments/tags/6.0.5/",
  "https://wordpress.org/plugins/quick-paypal-payments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quick-paypal-payments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-16"
 }
}