Vulnerabilities and security researches forwp-ecommerce-paypal wp-ecommerce-paypal
Direction: ascendingJun 07, 2024
Easy PayPal & Stripe Buy Now Button # CVE-2022-4628
- CVE, Research URL
- Application
- Date
- Feb 13, 2023
- Research Description
- The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Affected versions
-
max 1.7.4.
- Status
-
vulnerable
Easy PayPal & Stripe Buy Now Button # CVE-2024-1719
- CVE, Research URL
- Application
- Date
- Feb 28, 2024
- Research Description
- The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 1.9.
- Status
-
vulnerable
Easy PayPal & Stripe Buy Now Button # CVE-2023-51683
- CVE, Research URL
- Application
- Date
- Feb 28, 2024
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
- Affected versions
-
max 1.8.2.
- Status
-
vulnerable
Easy PayPal & Stripe Buy Now Button # f82adf6ff77a6966fa4bfb6b64e300af5e1504cc
- CVE, Research URL
- Application
- Date
- Jun 12, 2017
- Research Description
- Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal] < 1.7.3 Easy PayPal Buy Now Button <= 1.7.2 - Cross-Site Request Forgery to Cross-Site Scripting The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the wpecpp_settingsoptions function. This makes it possible for unauthenticated attackers to inject malicious JavaScript, that will execute whenever a user accesses the /wp-admin/options-general.php?page=wp-ecommerce-setting page, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 1.7.3.
- Status
-
vulnerable
Aug 13, 2024
Easy PayPal & Stripe Buy Now Button # CVE-2024-43236
- CVE, Research URL
- Application
- Date
- Aug 19, 2024
- Research Description
- URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
- Affected versions
-
max 1.9.1.
- Status
-
vulnerable
May 09, 2025
Easy PayPal & Stripe Buy Now Button # CVE-2025-47623
- CVE, Research URL
- Application
- Date
- May 07, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.
- Affected versions
-
max 2.0.1.
- Status
-
vulnerable
Jun 16, 2026
Easy PayPal & Stripe Buy Now Button # 4127b76c-4e4b-483b-8905-b5ca6d24337d
- CVE, Research URL
- Application
- Date
- -
- Research Description
- Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal] < 1.7.3 Easy PayPal Buy Now Button < 1.7.3 - CSRF to Stored Cross-Site Scripting The plugin does not have CSRF check in place when saving its settings, and does not sanitise as well as escape them when output in the page. As a result, an attacker could make a logged in admin change them via. CSRF attack and perform Cross-Site Scripting attacks. The plugin also fixed a Reflected XSS in web browsers which do not encode URL characters
- Affected versions
-
max 1.7.3.
- Status
-
vulnerable
Easy PayPal & Stripe Buy Now Button # eb1acbc5890fd73a492bbabb0e05f077d64032aa
- CVE, Research URL
- Application
- Date
- Jan 19, 2023
- Research Description
- Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal] < 1.7.3 WordPress Easy PayPal Buy Now Button Plugin < 1.7.3 is vulnerable to Cross Site Request Forgery (CSRF) Update the WordPress Easy PayPal Buy Now Button plugin to the latest available version (at least 1.7.3). WPScanTeam discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Easy PayPal Buy Now Button Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.7.3.
- Affected versions
-
max 1.7.3.
- Status
-
vulnerable
Aug 06, 2026
Easy PayPal & Stripe Buy Now Button # CVE-2026-65517
- CVE, Research URL
- Application
- Date
- Aug 06, 2026
- Research Description
- Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
- Affected versions
-
max 2.0.5.
- Status
-
vulnerable
Oct 04, 2026
Easy PayPal & Stripe Buy Now Button # CVE-2026-90987
- CVE, Research URL
- Application
- Date
- Oct 02, 2026
- Research Description
- The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.
- Affected versions
-
Min 1.8, max 2.0.6.
- Status
-
vulnerable