CVE-2026-62111

MediumCVSS 6.5

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Summary

The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or page content modification.

Recommendation

Update the Simple Payment plugin to a version newer than 2.5.4 once a fix is available and implement additional input filtering.

Other vulnerabilities in Simple Payment

See all

CVE-2026-81292High
Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.
CVE-2026-81767High
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.