CVE-2025-47518: Contact Form 7 PayPal Stripe XSS Flaw

CVE-2025-47518 Overview

CVE-2025-47518 is a stored Cross-Site Scripting (XSS) vulnerability in the Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress. The flaw affects all plugin versions up to and including 2.3.4. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. Stored payloads execute in the browsers of users who view the affected pages, enabling session theft, redirection, or administrative action abuse. The issue is classified under CWE-79.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in other users' browsers, enabling account compromise and content manipulation within the WordPress site.

Affected Products

Scott Paterson Contact Form 7 – PayPal & Stripe Add-on (contact-form-7-paypal-add-on)
All versions from n/a through <= 2.3.4
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-05-07 - CVE-2025-47518 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47518

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation in the Contact Form 7 – PayPal & Stripe Add-on plugin. User-controlled input reaches HTML output contexts without adequate sanitization or output encoding. This allows attackers with sufficient privileges to store crafted payloads that later render as executable JavaScript in a victim's browser.

Exploitation requires user interaction, and the impact crosses a trust boundary because the stored payload can execute in the context of other users who visit the affected pages. Successful exploitation compromises confidentiality, integrity, and availability of the WordPress session and rendered content. The EPSS probability is 0.264%, indicating a low near-term likelihood of mass exploitation, though targeted abuse remains feasible.

Root Cause

The root cause is missing or inadequate output encoding on plugin-managed data that is rendered inside HTML contexts. Input supplied through plugin settings or form-related fields is stored and later reflected without escaping functions such as esc_html(), esc_attr(), or wp_kses(). When a browser parses the response, the injected markup and script content execute.

Attack Vector

An attacker with elevated privileges on the WordPress instance submits a payload through a plugin input field that lacks server-side sanitization. The payload persists in the database. When another authenticated user, including administrators, loads a page that renders the stored data, the browser executes the injected script. Because the scope changes (S:C), scripts run in a context that can affect resources beyond the vulnerable component.

No verified public exploit code is available. Refer to the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-47518

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in plugin-related database fields.
Outbound requests from administrator browsers to unfamiliar domains following visits to plugin-managed pages.
Unauthorized administrative actions or session token use immediately after loading pages containing plugin output.

Detection Strategies

Query the wp_options and plugin-specific tables for HTML control characters and script keywords in fields that should contain plain text.
Inspect rendered HTML for plugin-controlled fields to confirm proper escaping is applied.
Review WordPress audit logs for privileged users editing plugin settings outside change windows.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) with rules that flag XSS payload patterns targeting WordPress admin endpoints.
Monitor Content Security Policy (CSP) violation reports for inline script executions on plugin-rendered pages.
Alert on new administrator account creation or role changes following plugin configuration edits.

How to Mitigate CVE-2025-47518

Immediate Actions Required

Identify all WordPress sites running the contact-form-7-paypal-add-on plugin at version 2.3.4 or earlier.
Restrict privileged plugin access to trusted administrators until a patched release is applied.
Audit plugin-related database fields for stored payloads and remove malicious content.

Patch Information

At the time of publication, the advisory indicates versions through <= 2.3.4 are affected. Consult the Patchstack XSS Vulnerability Advisory and the plugin's WordPress.org page for the latest fixed version and update immediately once available.

Workarounds

Deactivate and remove the plugin if a patched version is not yet available.
Deploy a WAF ruleset that blocks XSS payloads submitted to WordPress admin and plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts external script sources.
Limit plugin configuration privileges to a minimal set of administrator accounts protected by multi-factor authentication.

bash

# Configuration example: identify vulnerable plugin version via WP-CLI
wp plugin get contact-form-7-paypal-add-on --field=version

# Deactivate the plugin until patched
wp plugin deactivate contact-form-7-paypal-add-on