{
 "id": "WPSEC-2026-1848",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1848/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1848/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1848/index.md",
 "title": "Payment Forms for Paystack <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via Payment Form Submission Data",
 "description": "The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via payment form submission data in all versions up to, and including, 4.0.5, due to insufficient input sanitization and output escaping. The names of submitted form fields are stored as display names in the payment metadata and printed unescaped on the admin Submissions page. This makes it possible for unauthenticated attackers who complete a payment through a public payment form to inject arbitrary web scripts that will execute whenever an administrator views that form's submissions.",
 "plugin": {
  "slug": "payment-forms-for-paystack",
  "name": "Payment Forms for Paystack",
  "full_name": "Payment Forms for Paystack",
  "wordpress_org": "https://wordpress.org/plugins/payment-forms-for-paystack/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payment-forms-for-paystack/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.6",
 "remediation": "Update to 4.0.6 or later.",
 "fix_released": "2026-10-27T14:17:11+00:00",
 "published": "2026-10-28T14:51:26+00:00",
 "updated": "2026-10-28T09:20:17.383663+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1848/",
  "https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/",
  "https://wordpress.org/plugins/payment-forms-for-paystack/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}