CVE-2025-46499

Vulnerability

Overview The PayPal Express Checkout plugin for WordPress, versions 2.1.2 and earlier, contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This Stored XSS flaw allows an attacker to inject malicious scripts that are permanently stored on the server and executed in the browsers of other users when they access the affected page. The root cause is insufficient sanitization or validation of user-supplied data before it is included in output that is rendered by a victim's browser [1].

Exploitation

Conditions To exploit this vulnerability, an attacker must have a role that can submit input to the plugin, such as a contributor or subscriber, depending on the specific vulnerable field [1]. Successful exploitation does not require high privileges but does require user interaction: a victim (typically an administrator or other higher-privileged user) must perform an action such as clicking a link, visiting a crafted page, or submitting a form that triggers the stored payload [1]. The attack can be performed over the network without special access beyond the ability to inject content.

Impact

If exploited, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, theft of sensitive data (including authentication tokens), or forced actions on behalf of the victim within the WordPress admin panel. Given the prevalence of WordPress mass-exploit campaigns, this vulnerability may be targeted to compromise thousands of sites at once [1].

Mitigation

Users are strongly advised to update the PayPal Express Checkout plugin to a patched version immediately [1]. Those unable to update should seek assistance from their hosting provider or web developer to apply temporary workarounds, such as disabling the plugin or implementing a web application firewall (WAF) rule to block malicious input. No known permanent fix exists for unsupported versions [1].