Scott Paterson Contact Form 7 – PayPal & Stripe Add-on vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Latest Scott Paterson Contact Form 7 – PayPal & Stripe Add-on vulnerabilities

CVE-2026-66660 — WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability (CVSS 6.5)
CVE-2026-9189 — Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification) (CVSS 5.3)
CVE-2025-47518 — WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
CVE-2024-10683 — Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting (CVSS 6.1)
CVE-2024-48021 — WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2024-29130 — WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
CVE-2024-1719 — Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3)
CVE-2023-24405 — WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)