CVE-2026-115609

HighCVSS 7.1/10Last modified Oct 29, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Stiofan	GetPaid	<= 2.8.62

References

https://patchstack.com/database/wordpress/plugin/invoicing/vulnerability/wordpress-getpaid-plugin-2-8-62-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Oct 28, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-115619.8Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soag CVE-2026-1156106.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publ CVE-2026-1156117.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filte CVE-2026-1156127.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stor CVE-2026-1156136.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create CVE-2026-1156145.3Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiti CVE-2026-115624.3The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authentica CVE-2026-1156246.9GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi CVE-2026-1156276.0Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only t CVE-2026-115639.6The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have CVE-2026-1156356.0Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. W CVE-2026-1156384.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a