CVE-2026-111110

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.

• CWE-79

• https://github.com/AyeCode/invoicing/archive/refs/heads/master.zip
• https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/admin/meta-boxes/class-mb-payment-form.php#L30
• https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/class-wpinv-ajax.php#L359
• https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L293
• https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L402
• https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-payment-form-submission.php#L150
• https://plugins.trac.wordpress.org/changeset/3750463/invoicing/trunk/includes/admin/meta-boxes/class-mb-payment-form.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2161ecdc-d3c2-4ede-9c42-28f30fa0f91e?source=cve

Published

Oct 17, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111105Telegram rlottie Numeric Truncation Remote Code Execution Vu…7
• CVE-2026-111106The Mail Mint plugin for WordPress is vulnerable to SQL Inje…6.5
• CVE-2026-111107A NULL pointer dereference vulnerability in WatchGuard Firew…8.7
• CVE-2026-111108Apache Kafka's code-generated protocol readers pre-size an a…
• CVE-2026-111109The Webmention plugin for WordPress is vulnerable to Stored …6.1
• CVE-2026-11111Out of bounds read in ANGLE in Google Chrome prior to 149.0.…8.1
• CVE-2026-111111The Prime Slider – Hero Slider, Carousel, WooCommerce & Post…7.2
• CVE-2026-111114The Nexter Extension – Security, Performance, Code Snippets …7.5
• CVE-2026-111115Apache Kafka's code-generated readers for flexible protocol …
• CVE-2026-11112Insufficient validation of untrusted input in Chromoting in …9.6
• CVE-2026-111120The VikRentCar Car Rental Management System plugin for WordP…8.8
• CVE-2026-111122The SiteOrigin CSS plugin for WordPress is vulnerable to Sto…7.2