CVE-2026-96332
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Reflected XSS vulnerability in the Simple Payment plugin. Affects versions from n/a through 2.5.4.
Risk Assessment
An attacker can inject malicious script into the page, potentially leading to data theft or session hijacking.
Recommendation
Update the Simple Payment plugin to the latest available version that includes the security fix.
Other vulnerabilities in Simple Payment
See all- CVE-2026-62111Medium
The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.
- CVE-2026-81292High
Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.
- CVE-2026-81767High
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS