PT-2025-30113

CVE-2025-7669

Published

2025-07-18

Updated

2025-07-19

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avishi WP PayPal Payment Button versions prior to 2.1

Description The Avishi WP PayPal Payment Button plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the /avishi-wp-paypal-payment-button/index.php page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update Avishi WP PayPal Payment Button to version 2.1 or later.

Exploitability

Fix

Impacts

Researchers

Johannes Skamletz

Johska

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers