CVE-2026-111110: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid

CVE-2026-111110 is a stored Cross-Site Scripting vulnerability (CWE-79) in the stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'mmdwqzpoxadd' parameter in all plugin versions up to and including 2.8.61. An attacker can inject arbitrary web scripts that are stored and later executed when an administrator accesses the Payment Form Details metabox of an affected invoice. The exploitation does not require authentication because the nonce (getpaid_form_nonce) is publicly available to all visitors via wp_localize_script as WPInv.formNonce. This vulnerability has a CVSS 3.1 score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no impact on availability.

An unauthenticated attacker can inject persistent malicious scripts into the plugin's interface, which execute when an administrator views the affected invoice details. This can lead to partial confidentiality and integrity loss, such as theft of sensitive information or unauthorized actions performed in the administrator's context. There is no impact on system availability. The vulnerability affects all users running the plugin versions up to 2.8.61, potentially compromising administrative accounts.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when viewing invoice details and consider restricting access to trusted users only. Monitoring for plugin updates and applying them promptly when released is recommended.