CVE-2026-65517 describes an unauthenticated cross-site scripting (XSS) vulnerability in Easy PayPal Buy Now Button affecting versions up to 2.0.4. The vulnerability allows remote attackers to inject and execute arbitrary scripts without requiring authentication. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could lead to execution of arbitrary scripts in the context of users visiting affected sites, potentially resulting in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and consider implementing web application firewalls or input validation as temporary mitigations.