CVE-2026-108484
7.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute malicious scripts in victims' browsers by injecting stored payloads, potentially hijacking user sessions or modifying site content when viewed. Exploitation requires an unauthenticated attacker to submit input and a user to view the affected page.
Root cause
The plugin fails to sanitize and neutralize user input before rendering it on web pages, resulting in stored cross-site scripting.
Affected systems
Best Payments Plugin for WP (wp-payment-form) through version 4.6.27
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade Best Payments Plugin for WP to a version newer than 4.6.27 if available; otherwise, deactivate the plugin until a patched release is provided.
$ wp plugin update wp-payment-formAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.