CVE-2026-115609: WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability

Q: Which GetPaid versions are affected?

The issue affects GetPaid through version 2.8.62. The available data does not identify a fixed version.

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that no privileges are required and exploitation can be performed over the network, but it requires user interaction. The vulnerability is a stored XSS issue, so impact occurs when stored malicious content is rendered in a web page.

Q: What is the potential impact?

The vulnerability has low confidentiality, integrity, and availability impacts, and its scope is changed. A successful exploit could affect users who interact with a page rendering the stored payload.

Published Oct 28, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.

Affected Software

1 affected component

Stiofan GetPaid<=2.8.62

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress GetPaid plugin to a version that resolves this vulnerability.
Fixed in 2.8.63

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which GetPaid versions are affected?

The issue affects GetPaid through version 2.8.62. The available data does not identify a fixed version.

What access does an attacker need to exploit this issue?

The CVSS vector indicates that no privileges are required and exploitation can be performed over the network, but it requires user interaction. The vulnerability is a stored XSS issue, so impact occurs when stored malicious content is rendered in a web page.

What is the potential impact?

The vulnerability has low confidentiality, integrity, and availability impacts, and its scope is changed. A successful exploit could affect users who interact with a page rendering the stored payload.

CVE-2026-115609: WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which GetPaid versions are affected?

What access does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which GetPaid versions are affected?

What access does an attacker need to exploit this issue?

What is the potential impact?