WordPress plugin
Payment forms, Buy now buttons, and Invoicing System | GetPaid security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium8
- Low0
All Payment forms, Buy now buttons, and Invoicing System | GetPaid vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Unauthenticated Insecure Direct Object Reference ≤2.8.62Update to 2.8.63 | CVE-2026-119748 | |
| Medium5.3 | Unauthenticated Payment Processing Bypass ≤2.8.62Update to 2.8.63 | CVE-2026-119749 | |
| Medium4.3 | Missing Authorization ≤2.8.62Update to 2.8.63 | CVE-2026-119747 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤2.8.62Update to 2.8.63 | CVE-2026-115609 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter ≤2.8.61Update to 2.8.62 | CVE-2026-111110 | |
| Medium6.6 | Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field ≤2.8.56Update to 2.8.57 | CVE-2026-17605 | |
| Medium5.3 | Unauthenticated Payment Bypass ≤2.8.54Update to 2.8.55 | CVE-2026-12901 | |
| Medium5.3 | Unauthenticated Information Exposure ≤2.8.49Update to 2.8.50 | CVE-2026-49064 | |
| Medium4.3 | Missing Authorization via column_subscription() ≤2.8.11Update to 2.8.12 | CVE-2024-43973 | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting ≤2.3.3Update to 2.3.4 | CVE-2021-24369 |
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤2.8.62Update to 2.8.63
- Medium5.3Unauthenticated Payment Processing Bypass
≤2.8.62Update to 2.8.63
- Medium4.3Missing Authorization
≤2.8.62Update to 2.8.63
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.62Update to 2.8.63
- High7.2Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
≤2.8.61Update to 2.8.62
- Medium6.6Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
≤2.8.56Update to 2.8.57
- Medium5.3Unauthenticated Payment Bypass
≤2.8.54Update to 2.8.55
- Medium5.3Unauthenticated Information Exposure
≤2.8.49Update to 2.8.50
- Medium4.3Missing Authorization via column_subscription()
≤2.8.11Update to 2.8.12
- Medium5.4Authenticated Stored Cross-Site Scripting
≤2.3.3Update to 2.3.4
Payment forms, Buy now buttons, and Invoicing System | GetPaid: common questions
Does Payment forms, Buy now buttons, and Invoicing System | GetPaid have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in Payment forms, Buy now buttons, and Invoicing System | GetPaid: 2 high, 8 medium. None are known to affect version null.
How do I check which version of Payment forms, Buy now buttons, and Invoicing System | GetPaid I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Payment forms, Buy now buttons, and Invoicing System | GetPaid vulnerability?
CVE-2026-119748, published Nov 4, 2026: Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference. Severity: Medium (CVSS 5.3).
Is any Payment forms, Buy now buttons, and Invoicing System | GetPaid vulnerability listed in CISA KEV?
No. None of the known Payment forms, Buy now buttons, and Invoicing System | GetPaid vulnerabilities is currently listed in the CISA KEV catalog.