CVE-2025-11859: Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1. This is due to the plugin not properly sanitizing user input and output of the 'title' and 'text' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11859?
CVE-2025-11859 is considered a medium severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-11859?
To fix CVE-2025-11859, update the Paypal Donation Shortcode plugin to a version that properly sanitizes user inputs.
What versions are affected by CVE-2025-11859?
CVE-2025-11859 affects all versions of the Paypal Donation Shortcode plugin up to and including version 0.1.
What kind of attack does CVE-2025-11859 facilitate?
CVE-2025-11859 facilitates Stored Cross-Site Scripting attacks by allowing malicious script execution through unsanitized user input.
Who are the affected users of CVE-2025-11859?
Users of WordPress sites utilizing the Paypal Donation Shortcode plugin versions up to 0.1 are affected by CVE-2025-11859.