Is CVE-2021-47948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47948 being exploited in the wild.

How severe is CVE-2021-47948?

Medium severity, with a CVSS score of 5.4, published 10 May 2026.

Is there a fix for CVE-2021-47948?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-47948 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-47948?

Check whether you run GetPaid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47948: WordPress GetPaid Plugin HTML injection in Help Text field

CVE-2021-47948 · Severity: medium · CVSS 5.4 · Published 2026-05-10

The GetPaid plugin for WordPress, which handles online payments and invoicing, contains a security flaw in its payment form creation tool. An authorized user can inject malicious code into the 'Help Text' field of a payment form, which is then stored and executed in the browsers of other users who view that form. This could lead to unauthorized actions, data theft, or the display of fraudulent content to customers during the checkout process.

Technologies: GetPaid. Vendors: GetPaid.

Quick answers

Is CVE-2021-47948 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47948 being exploited in the wild.
How severe is CVE-2021-47948?: Medium severity, with a CVSS score of 5.4, published 10 May 2026.
Which products and versions are affected?: GetPaid 2.4.6.
Is there a fix for CVE-2021-47948?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-47948 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-47948?: Check whether you run GetPaid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored HTML injection (Basic XSS) vulnerability exists in the WordPress GetPaid plugin version 2.4.6. The flaw is located in the 'Help Text' field within the payment form creation interface (GetPaid > Payment Forms > Add New). Due to improper neutralization of user-supplied input (CWE-80), an authenticated attacker with permissions to create or edit payment forms can inject arbitrary HTML and JavaScript. This payload is stored in the database and executed when a victim (such as a customer or administrator) views the affected payment form. An exploit can lead to session hijacking, unauthorized redirection, or defacement of the payment interface.

Affected products

invoicing Payments Plugin GetPaid 2.4.6

Timeline

2021-08-29: disclosed: Original exploit discovery by Niraj Mahajan
2021-09-01: other: Exploit published on Exploit-DB
2026-05-10: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.