CVE-2025-13966

Name of the Vulnerable Software and Affected Versions Paypal Payment Shortcode versions prior to 1.02

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts into pages via the buttom image parameter of the [paypal-shortcode] shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update the plugin to a version newer than 1.01. As a temporary mitigation, restrict the use of the buttom image parameter within the [paypal-shortcode] shortcode.