CVE-2026-4072: 
WordPress vulnerability analysis and mitigation

CVE-2026-4072 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress PayPal Donation plugin affecting all versions up to and including 1.01. The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the donate shortcode's unsanitized attributes. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), stemming from insufficient input sanitization and output escaping in the wordpress_paypal_donation_create() function (Wordfence). The function uses extract(shortcode_atts(...)) to process shortcode attributes — including amount, email, title, return_url, cancel_url, ccode, and image — and then directly interpolates these values into HTML output within single-quoted attribute values without any escaping (WordPress Trac). An attacker with at least Contributor-level WordPress access can embed a malicious [donate] shortcode in a post or page; the injected script executes in the browser of any visitor who loads the affected page. No special configuration is required beyond having the plugin active and the attacker having post-creation privileges.

Successful exploitation allows persistent JavaScript execution in the context of any site visitor's browser session, enabling session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. Because the script is stored server-side and executes for every visitor of the injected page, the blast radius extends to all users — including administrators — who view the compromised content. Confidentiality and integrity are both impacted (low severity per CVSS), while availability is unaffected (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of near-term exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits opportunistic mass exploitation but remains a realistic threat in multi-author WordPress environments.

1. Reconnaissance: Identify WordPress sites running the PayPal Donation plugin version ≤ 1.01 using tools like WPScan (wpscan --url https://target.com --enumerate p) or by checking /wp-content/plugins/wordpress-paypal-donation/ for the plugin's readme or version file.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Create or edit a post: Log in and navigate to Posts → Add New in the WordPress dashboard.
4. Inject malicious shortcode: Insert a crafted [donate] shortcode with a payload in one of the unsanitized attributes, for example:

   [donate amount="1" email="x' onmouseover='alert(document.cookie)" title="Donate"]

   or using an image attribute to load an external resource that triggers script execution.
5. Publish the post: Submit the post for review or publish it directly (depending on role permissions).
6. Trigger execution: When any site visitor (including an administrator) loads the page containing the injected shortcode, the malicious script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or wp-json/wp/v2/posts from Contributor-level accounts containing [donate shortcode strings with unusual attribute values (e.g., event handlers like onmouseover, onerror, or JavaScript URIs).
• Database: Suspicious entries in the wp_posts table where post content includes [donate shortcodes with attributes containing HTML event handlers or encoded JavaScript (javascript:, %3Cscript%3E, etc.).
• Network: Outbound requests from visitor browsers to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages hosting the [donate] shortcode.
• File System: Unexpected modifications to plugin files under wp-content/plugins/wordpress-paypal-donation/ that may indicate secondary tampering after initial XSS exploitation.

As of the disclosure date, no patched version of the WordPress PayPal Donation plugin beyond 1.01 has been confirmed as available; administrators should monitor the WordPress plugin repository for an updated release (Wordfence). In the interim, site administrators should disable or remove the plugin until a fix is released. Additionally, restrict post-creation permissions to trusted users only, and consider deploying a Web Application Firewall (WAF) rule to block shortcode attributes containing JavaScript event handlers or URI schemes. Wordfence users with premium subscriptions may have firewall rules available to mitigate exploitation attempts.

The vulnerability was discovered and disclosed by Wordfence, which maintains the authoritative advisory (Wordfence). Coverage has been limited to automated vulnerability aggregators and security feed services; no notable independent researcher commentary or significant social media discussion has been identified at this time.