Online Payments – Get Paid with PayPal, Square & Stripe
paypal-payment-button-by-vcita · plugin
Known security vulnerabilities for Online Payments – Get Paid with PayPal, Square & Stripe. Find out in seconds which version runs on your site with WP Lens.
4 known vulnerabilities
1 exploitable without logging in · latest Feb 18, 2025
Listed on wordpress.org · latest 3.30.0 · last updated Mar 16, 2025 · 100+ installs
wordpress.org status checked on Oct 8, 2026
Vulnerabilities
- Medium 6.5
CVE-2023-2407unauthenticated · needs a click
Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.10.0 - Cross-Site Request Forgery to Stored Cross-S
- Medium 6.5
CVE-2025-22661login required≤ 3.20.0
WordPress Online Payments plugin <= 3.20.0 - Cross Site Scripting (XSS) vulnerability
- Medium 5.4
CVE-2024-11895contributor+≤ 3.20.0
Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 5.4
CVE-2023-2406contributor+
Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Sit
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).