Vulnerabilities / Payment Forms for Paystack / WPSEC-2026-1848
Payment Forms for Paystack <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via Payment Form Submission Data
High 7.2
CWE-79Fixed in 4.0.6
- ID
- WPSEC-2026-1848
- Plugin
- Payment Forms for Paystack (payment-forms-for-paystack)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Payment Forms for Paystack on WPSec AttackSurface
- Fix released
- Published
Description
The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via payment form submission data in all versions up to, and including, 4.0.5, due to insufficient input sanitization and output escaping. The names of submitted form fields are stored as display names in the payment metadata and printed unescaped on the admin Submissions page. This makes it possible for unauthenticated attackers who complete a payment through a public payment form to inject arbitrary web scripts that will execute whenever an administrator views that form's submissions.
References
- https://wpsec.com/vuln/WPSEC-2026-1848/
- https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/
- https://wordpress.org/plugins/payment-forms-for-paystack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS