# Payment Forms for Paystack <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via Payment Form Submission Data

- **ID:** WPSEC-2026-1848
- **Plugin:** Payment Forms for Paystack (`payment-forms-for-paystack`), https://wordpress.org/plugins/payment-forms-for-paystack/
- **Affected versions:** all versions before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1848/

## Description

The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via payment form submission data in all versions up to, and including, 4.0.5, due to insufficient input sanitization and output escaping. The names of submitted form fields are stored as display names in the payment metadata and printed unescaped on the admin Submissions page. This makes it possible for unauthenticated attackers who complete a payment through a public payment form to inject arbitrary web scripts that will execute whenever an administrator views that form's submissions.

## References

- https://wpsec.com/vuln/WPSEC-2026-1848/
- https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/
- https://wordpress.org/plugins/payment-forms-for-paystack/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1848/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.