CVE-2026-62111
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or page content modification.
Recommendation
Update the Simple Payment plugin to a version newer than 2.5.4 once a fix is available and implement additional input filtering.
Other vulnerabilities in Simple Payment
See all- CVE-2026-96332High
Reflected XSS vulnerability in the Simple Payment plugin. Affects versions from n/a through 2.5.4.
- CVE-2026-81292High
Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.
- CVE-2026-81767High
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS