The GetPaid plugin for WordPress contains a stored Cross‑Site Scripting vulnerability triggered by the unfiltered ‘mmdwqzpoxadd’ parameter. The flaw allows an unauthenticated attacker to inject arbitrary JavaScript that is saved in the database and automatically executed whenever an administrator opens an invoice’s Payment Form Details metabox. This client‑side execution can lead to credential theft, session hijacking, or redirection to malicious sites, compromising the confidentiality and integrity of admin sessions.

This vulnerability is present in all releases of the GetPaid plugin version 2.8.61 and earlier. Any WordPress installation that has the stiofansisland:GetPaid plugin installed in a version up to 2.8.61 is impacted. The flaw originates from the administration meta‑boxes handling the ‘mmdwqzpoxadd’ parameter and is not restricted to a specific configuration or user role.

The CVSS v3.1 score of 7.2 reflects a high‑severity flaw that requires no authentication to exploit; the nonce required by the plugin is publicly emitted to all visitors, removing the prerequisite of a logged‑in user. While the EPSS score is not available, the absence of a KEV listing does not diminish the risk, as the attack path is straightforward: an attacker sends a request containing a malicious ‘mmdwqzpoxadd’ payload, which becomes stored and later executed when an administrator views the invoice. Successful exploitation enables arbitrary code execution in the context of the administrator’s browser, allowing for credential theft or further lateral movement.