# Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via Payment Form Custom Field Data

- **ID:** WPSEC-2026-1188
- **Plugin:** Payment forms, Buy now buttons, and Invoicing System | GetPaid (`invoicing`), https://wordpress.org/plugins/invoicing/
- **Affected versions:** all versions before 2.8.62
- **Fixed in:** 2.8.62 (Update to 2.8.62 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoicing
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1188/

## Description

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via payment form custom field values in all versions up to, and including, 2.8.61, due to insufficient input sanitization and output escaping. Submitted custom field values were only filtered with wp_kses_post(), which keeps data-* attributes such as data-bs-toggle="popover-html" and data-bs-content. The bundled AyeCode UI script renders these as unsanitized HTML popovers. This makes it possible for unauthenticated attackers who submit a payment form to inject arbitrary web scripts that execute when an administrator views the invoice's Payment Form Details in the admin area and interacts with the injected element.

## References

- https://wpsec.com/vuln/WPSEC-2026-1188/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.62/
- https://wordpress.org/plugins/invoicing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1188/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.