CVE-2026-108484: WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPManageNinja Best Payments Plugin for WPto a version that resolves this vulnerability.Fixed in 4.6.28
Event History
Frequently Asked Questions
Which installations are affected?
Best Payments Plugin for WP installations running wp-payment-form version 4.6.27 or earlier are affected. The available data does not identify a fixed version.
What access does an attacker need?
The vector is network-based and requires no privileges, but exploitation requires user interaction. The vulnerability is a stored XSS issue, meaning attacker-supplied content can be retained and later rendered in a web page.
What impact can successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at a low level. Because scope is changed, the impact may extend beyond the vulnerable component's own security authority.