Security Alert Summary
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.8.61. An unauthenticated attacker can inject a script via a specific parameter because input is not properly sanitized or escaped, and the required nonce is exposed to all visitors. The injected payload can execute when an administrator views the affected invoice Payment Form Details metabox.
CVE Details
- CVE ID: CVE-2026-111110
- Affected component: Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress
- Affected versions: All versions up to and including 2.8.61
- Published: October 17, 2026 at 8:16:28 AM UTC
- Last modified: October 17, 2026 at 8:16:28 AM UTC
- CVSS v3.1 base score: 7.2
- Severity: HIGH
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Attack vector: NETWORK
- Attack complexity: LOW
- Privileges required: NONE
- User interaction: NONE
- Scope: CHANGED
- Impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin fails to sufficiently sanitize and escape input for a parameter named mmdwqzpoxadd, allowing stored cross-site scripting. The nonce used to protect form actions, getpaid_form_nonce, is exposed to all visitors via wp_localize_script as WPInv.formNonce, so an attacker does not need prior access to a nonce value. Because the payload is stored, the malicious script executes when an administrator or another privileged user views the affected invoice Payment Form Details metabox.
This vulnerability exists due to missing input validation and output escaping on stored data paths that render user-supplied content in the admin metabox. The impact is limited to execution of attacker-supplied scripts in the context of a viewing user; it does not by itself indicate remote code execution on the server.
How This Could Impact Your Website
Consider a small business site where the site owner manages invoices, internal staff view invoice details, and an external contractor occasionally submits payment forms. An attacker who injects a stored XSS payload can cause scripts to run when administrators or staff view an invoice, which could expose information visible in the browser context such as user email addresses or enable actions that target those users. This increases the risk of targeted phishing or social engineering against administrators and staff.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially contributor and author level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site and admin activity logs for unusual behavior, especially accesses to invoice or payment form admin pages.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/AyeCode/invoicing/archive/refs/heads/master.zip
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/admin/meta-boxes/class-mb-payment-form.php#L30
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/class-wpinv-ajax.php#L359
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L293
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L402
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-payment-form-submission.php#L150
- https://plugins.trac.wordpress.org/changeset/3750463/invoicing/trunk/includes/admin/meta-boxes/class-mb-payment-form.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2161ecdc-d3c2-4ede-9c42-28f30fa0f91e?source=cve
