Executive brief
The GetPaid plugin for WordPress, which handles online payments and invoicing, contains a security flaw in its payment form creation tool. An authorized user can inject malicious code into the 'Help Text' field of a payment form, which is then stored and executed in the browsers of other users who view that form. This could lead to unauthorized actions, data theft, or the display of fraudulent content to customers during the checkout process.
Technical details
A stored HTML injection (Basic XSS) vulnerability exists in the WordPress GetPaid plugin version 2.4.6. The flaw is located in the 'Help Text' field within the payment form creation interface (GetPaid > Payment Forms > Add New). Due to improper neutralization of user-supplied input (CWE-80), an authenticated attacker with permissions to create or edit payment forms can inject arbitrary HTML and JavaScript. This payload is stored in the database and executed when a victim (such as a customer or administrator) views the affected payment form. An exploit can lead to session hijacking, unauthorized redirection, or defacement of the payment interface.
Affected products
- invoicing Payments Plugin GetPaid 2.4.6
Timeline
- 2021-08-29: disclosed: Original exploit discovery by Niraj Mahajan
- 2021-09-01: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD publication date