{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3617", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-05T19:00:50.086Z", "datePublished": "2026-03-21T03:26:58.740Z", "dateUpdated": "2026-04-08T17:14:06.298Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:06.298Z"}, "affected": [{"vendor": "swergroup", "product": "Paypal Shortcodes", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Paypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L106"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L106"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L105"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L105"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L89"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L89"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2026-03-20T15:07:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:30:45.294786Z", "id": "CVE-2026-3617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:30:54.104Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:30:45.294786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:30:50.993Z"}}], "cna": {"title": "Paypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "swergroup", "product": "Paypal Shortcodes", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:07:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L106"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L106"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L105"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L105"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L89"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L89"}], "descriptions": [{"lang": "en", "value": "The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:06.298Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3617", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:06.298Z", "dateReserved": "2026-03-05T19:00:50.086Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:58.740Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Paypal Shortcode para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los atributos de shortcode 'amount' y 'name' en todas las versiones hasta la 0.3, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos de shortcode proporcionados por el usuario. La funci\u00f3n swer_paypal_shortcode() extrae los atributos de shortcode usando extract() y shortcode_atts() en la l\u00ednea 89, luego concatena directamente los valores $name y $amount en los atributos de valor de los elementos de entrada HTML en las l\u00edneas 105-106 sin aplicar esc_attr() ni ninguna otra funci\u00f3n de escape. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-3617", "lastModified": "2026-04-24T16:27:44.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-21T04:17:30.233", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L105"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L106"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L89"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L105"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L106"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L89"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Paypal Shortcodes", "source": "cna", "vendor": "swergroup"}, "product": "paypal_shortcodes", "vendor": "swergroup"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:35:21.242162+00:00", "value": {"mitigation_remediation": ["Upgrade the Paypal Shortcodes plugin to a version newer than 0.3 or uninstall the plugin", "Revoke Contributor or higher roles from users who do not need them and review existing permissions", "If an upgrade is not possible immediately, apply server\u2011side sanitization and escape to the \"amount\" and \"name\" attributes before inserting them into the page", "Monitor the site for unexpected scripts or modifications to pages and audit plugin files regularly"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that run the Paypal Shortcodes plugin version 0.3 or earlier, developed by swergroup. Only users with Contributor or higher privileges can add or modify the problematic shortcode attributes, but once a payload is stored it affects all visitors who load the affected page.", "description_and_impact": "The plugin processes shortcode attributes without escaping or sanitizing them and inserts the raw values into the \"name\" and \"amount\" input fields of an HTML form. This allows an attacker who can edit these attributes to embed JavaScript that will run whenever the page containing the shortcode is viewed. The description indicates that the injected script values are stored in the database and rendered on page load, which indicates a stored XSS. Based on the description, it is inferred that an attacker could use the resulting script to hijack user sessions, steal cookies, deface pages, or redirect users to malicious sites, thereby compromising confidentiality, integrity, and availability of the site.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity. The exploit requires an authenticated user with Contributor privileges and no publicly available exploit code is known. The vulnerability is not listed in the CISA KEV catalog and EPSS data is not available. Because the attack vector is limited to authenticated contributors, the likelihood of widespread exploitation is moderate, though sites that share contributor access or have compromised contributor accounts are at increased risk. The required privilege level and absence of public exploits reduce the probability of immediate exploitation, yet the impact of successful execution would be serious."}}}}, "created": "2026-03-23T09:50:07.662278+00:00", "updated": "2026-03-25T14:41:48.358579+00:00", "vendors": ["swergroup", "swergroup$PRODUCT$paypal_shortcodes", "wordpress", "wordpress$PRODUCT$wordpress"]}