CVE-2026-3617

The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The swer_paypal_shortcode() function extracts shortcode attributes using extract() and shortcode_atts() at line 89, then directly concatenates the $name and $amount values into HTML input element value attributes at lines 105-106 without applying esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L105
• https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L106
• https://plugins.trac.wordpress.org/browser/paypal-shortcodes/tags/0.3/paypal-shortcodes.php#L89
• https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L105
• https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L106
• https://plugins.trac.wordpress.org/browser/paypal-shortcodes/trunk/paypal-shortcodes.php#L89
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3612A vulnerability was determined in Wavlink WL-NU516U1 V240425…7.3
• CVE-2026-3613A vulnerability was identified in Wavlink WL-NU516U1 V240425…7.3
• CVE-2026-3614The AcyMailing plugin for WordPress is vulnerable to privile…8.8
• CVE-2026-3616A vulnerability was detected in DefaultFuction Jeson Custome…6.3
• CVE-2026-36162An authenticated stored cross-site scripting (XSS) vulnerabi…5.4
• CVE-2026-36163An HTML injection vulnerability in the file view endpoint of…5.4
• CVE-2026-36174GNCC GP5 v7.1.76 was discovered to store sensitive wireless …4.6
• CVE-2026-36175An issue in the U-Boot component of GNCC GP5 v7.1.76 allows …6.8
• CVE-2026-36176GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaz…7.1
• CVE-2026-36178The factory reset functionality in GNCC GP5 v7.1.76 fails to…4.6
• CVE-2026-3618The Columns by BestWebSoft plugin for WordPress is vulnerabl…6.4
• CVE-2026-36180A lack of runtime integrity in GNCC GP5 v7.1.76 allows physi…4.6