Medium severity5.4NVD Advisory· Published May 10, 2026· Updated May 12, 2026

CVE-2021-47948

Description

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during payment form creation, which gets stored in the database and executed in the browser when the form is viewed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Invoicingreferences
Package: https://wordpress.org/plugins/invoicing
WordPress/WordPressllm-fuzzy
Range: =2.4.6
Package: https://wordpress.org/plugins/wordpress

Patches

Vulnerability mechanics

References

wordpress.org/plugins/invoicing/nvd
www.exploit-db.com/exploits/50246nvd
www.vulncheck.com/advisories/wordpress-getpaid-plugin-html-injection-via-help-textnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000