CVE-2026-96332: WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Simple Payment pluginto a version that resolves this vulnerability.Fixed in 2.5.6
Event History
Frequently Asked Questions
Who can exploit this issue?
The published vector is network-accessible and requires no privileges, but exploitation requires user interaction. An attacker would need to induce a user to access a crafted request or page that triggers the reflected XSS.
Which installations are affected?
Simple Payment versions through 2.5.4 are affected. The available data does not identify a fixed version, so deployments running 2.5.4 or an earlier version should be treated as potentially vulnerable.
What is the likely impact if exploitation succeeds?
Successful reflected XSS can affect confidentiality, integrity, and availability at low impact levels, and the scope is changed. The exact application actions available to injected script are not specified in the provided data.