CVE-2026-3617 is a stored cross-site scripting vulnerability in the swergroup Paypal Shortcodes WordPress plugin versions up to 0.3. The vulnerability arises from insufficient input sanitization and output escaping of the 'amount' and 'name' shortcode attributes. Specifically, the swer_paypal_shortcode() function uses extract() and shortcode_atts() to retrieve these attributes and then directly concatenates them into HTML input element value attributes without applying esc_attr() or equivalent escaping functions. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages.

An attacker with Contributor-level or higher access can inject malicious scripts into pages using the vulnerable shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions on affected sites.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Paypal Shortcodes plugin if possible to prevent exploitation.