Description

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T19:17:43.987Z",
  "pubdate": "2026-09-11T19:17:43.987Z",
  "executiveSummary": "The Simple Payment plugin, in all versions up to and including 2.5.4, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability originating from a lack of adequate input sanitization for contributor-level users.\nThis vulnerability permits authenticated users with contributor privileges to inject malicious JavaScript payloads into the application. When these payloads are rendered within the administrative interface, the script executes in the context of the victim's browser session.\nThe impact includes potential account takeover, unauthorized administrative actions, and the exfiltration of sensitive session tokens or data. Because the vulnerability exists within the input handling logic for contributors, it represents a significant elevation of privilege risk if an administrative user views the injected content.\nExploitation requires the attacker to possess valid contributor-level credentials. No complex network interception is required, as the payload is stored directly within the application's database. Organizations using Simple Payment 2.5.4 or earlier are advised to restrict user roles or apply rigorous input filtering until a security patch is deployed.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of user-supplied data during the submission process within the Simple Payment plugin. The application fails to sanitize or escape input fields accessible to users with the 'contributor' capability before persisting the data to the underlying database.\nThe attack flow begins with an authenticated contributor crafting a malicious payload containing JavaScript, such as '<script>alert(document.cookie)</script>', and submitting it through the plugin's interface. Because the plugin does not implement output encoding or context-aware sanitization, the application stores this raw malicious string.\nThe vulnerability is triggered when an administrator or higher-privileged user navigates to the administrative section of the Simple Payment plugin where the submitted data is retrieved and rendered. The browser interprets the injected script tag as legitimate code rather than harmless text, leading to execution in the victim's browser environment.\nSince the script executes within the context of the administrative session, the attacker can perform actions with the privileges of the victim, such as modifying plugin configurations, creating new administrative accounts, or redirecting the user to malicious external sites.\nThe attack surface is limited to authenticated contributors, meaning a threat actor must first bypass initial authentication or compromise a legitimate user account. However, since the payload is stored, the attack is asynchronous, meaning the administrator does not need to be online at the exact moment the contributor submits the payload. The impact remains persistent until the malicious entry is identified and purged from the database.\nAffected components include the data-handling functions responsible for saving and rendering contributor-submitted inputs. The lack of adherence to secure coding standards—specifically regarding the omission of functions like esc_html() or wp_kses_post()—facilitates the injection of arbitrary scripts. Version 2.5.4 and all prior releases are confirmed to contain these insecure processing routines, providing a reliable vector for Cross-Site Scripting."
}