CVE-2021-47948CWE-80

WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text

Medium · published May 10, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during payment form creation, which gets stored in the database and executed in the browser when the form is viewed.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00169 · 6.0th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-05-10T12:44Z
EPSS history
Timeline
  • 10 MAY 12:44Z
    WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text
    cvelistv5