CVE-2022-2565: Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site Scripting

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-05 · updated 2026-06-17
Weakness: CWE-79

Description

The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins

Affected products

Simple Payment Donations & Subscriptions Plugin by Paymattic – Best Payments Plugin for WP: before 4.2.1 — fixed in 4.2.1

How to fix

Upgrade to a fixed version: Simple Payment Donations & Subscriptions Plugin by Paymattic – Best Payments Plugin for WP 4.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-2565 or the next vulnerability affects your stack