{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4072", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-12T19:46:38.507Z", "datePublished": "2026-03-21T03:26:56.908Z", "dateUpdated": "2026-04-08T17:10:56.760Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:56.760Z"}, "affected": [{"vendor": "tstachl", "product": "WordPress PayPal Donation", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.01", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'amount', 'email', 'title', 'return_url', 'cancel_url', 'ccode', and 'image'. The wordpress_paypal_donation_create() function uses extract(shortcode_atts(...)) to process shortcode attributes and then directly interpolates these values into HTML output within single-quoted attribute values without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99a8b48b-2967-4179-a0eb-626bbe273f03?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/trunk/wp-paypal-donation.php#L271"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/tags/1.01/wp-paypal-donation.php#L271"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/trunk/wp-paypal-donation.php#L260"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/tags/1.01/wp-paypal-donation.php#L260"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2026-03-20T15:07:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T17:08:00.403230Z", "id": "CVE-2026-4072", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T17:08:21.312Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T17:08:00.403230Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T17:08:13.571Z"}}], "cna": {"title": "WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tstachl", "product": "WordPress PayPal Donation", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.01"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:07:36.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99a8b48b-2967-4179-a0eb-626bbe273f03?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/trunk/wp-paypal-donation.php#L271"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/tags/1.01/wp-paypal-donation.php#L271"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/trunk/wp-paypal-donation.php#L260"}, {"url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/tags/1.01/wp-paypal-donation.php#L260"}], "descriptions": [{"lang": "en", "value": "The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'amount', 'email', 'title', 'return_url', 'cancel_url', 'ccode', and 'image'. The wordpress_paypal_donation_create() function uses extract(shortcode_atts(...)) to process shortcode attributes and then directly interpolates these values into HTML output within single-quoted attribute values without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-21T03:26:56.908Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4072", "state": "PUBLISHED", "dateUpdated": "2026-03-23T17:08:21.312Z", "dateReserved": "2026-03-12T19:46:38.507Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:56.908Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'amount', 'email', 'title', 'return_url', 'cancel_url', 'ccode', and 'image'. The wordpress_paypal_donation_create() function uses extract(shortcode_atts(...)) to process shortcode attributes and then directly interpolates these values into HTML output within single-quoted attribute values without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin WordPress PayPal Donation para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'donate' en todas las versiones hasta la 1.01, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos de shortcode proporcionados por el usuario, como 'amount', 'email', 'title', 'return_url', 'cancel_url', 'ccode' e 'image'. La funci\u00f3n wordpress_paypal_donation_create() utiliza extract(shortcode_atts(...)) para procesar los atributos del shortcode y luego interpola directamente estos valores en la salida HTML dentro de valores de atributos entre comillas simples sin ning\u00fan escape. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-4072", "lastModified": "2026-04-24T16:27:44.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-21T04:17:40.413", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/tags/1.01/wp-paypal-donation.php#L260"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/tags/1.01/wp-paypal-donation.php#L271"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/trunk/wp-paypal-donation.php#L260"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wordpress-paypal-donation/trunk/wp-paypal-donation.php#L271"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99a8b48b-2967-4179-a0eb-626bbe273f03?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.01]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WordPress PayPal Donation", "source": "cna", "vendor": "tstachl"}, "product": "wordpress_paypal_donation", "vendor": "tstachl"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:35:32.348422+00:00", "value": {"mitigation_remediation": ["Update WordPress PayPal Donation to the latest version that patches the input sanitization and output escaping issues.", "If an update is not immediately available, disable or delete the plugin to stop further exploitation.", "Remove any instances of the donate shortcode that contain suspicious or untrusted attribute values from posts, pages, and widgets.", "Audit the site for remnants of injected scripts and clean them manually.", "Restrict Contributor-level permissions to trusted users to reduce the risk of accidental or malicious injections."], "summary": {"action": "Immediate patch", "impact": "Stored cross\u2011site scripting via the PayPal Donation shortcode allows malicious scripts to be inserted into pages"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed WordPress PayPal Donation up to and including version 1.01 are affected. Site administrators and content editors with Contributor or higher privileges can exploit the vulnerability by embedding malicious shortcode attributes into posts, pages, or widgets that include the donate shortcode.", "description_and_impact": "The WordPress PayPal Donation plugin is vulnerable to stored XSS because shortcode attributes such as amount, email, title, return_url, cancel_url, ccode, and image are not sanitized or escaped. When an authenticated user with Contributor-level access or higher inserts malicious code into these attributes, the plugin interpolates the values directly into HTML output without filtering. This permits an attacker to inject arbitrary JavaScript, which will execute whenever a user views the affected page.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is a web application requiring authenticated access with Contributor privileges. Once code is injected, it runs for any visitor to the page, potentially allowing attackers to deface content, steal session data, or perform phishing attacks. Based on the description, it is inferred that the impact could include unintended script execution and data exfiltration for unsuspecting users."}}}}, "created": "2026-03-23T09:50:11.403605+00:00", "updated": "2026-03-25T14:41:52.320538+00:00", "vendors": ["tstachl", "tstachl$PRODUCT$wordpress_paypal_donation", "wordpress", "wordpress$PRODUCT$wordpress"]}