CVE-2026-108484

Deferred Deferred - Pending Action

Stored XSS in Best Payments Plugin for WP

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108484

EUVD

EUVD-2026-101527

Affected Vendors & Products

Vendor	Product	Version / Range
WPManageNinja	Best	Payments Plugin for WP 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the WPManageNinja Best Payments Plugin for WordPress. It allows attackers to inject malicious scripts into web pages by exploiting improper input neutralization during page generation. The vulnerability exists in versions up to 4.6.27.

Detection Guidance

Detecting this XSS vulnerability requires checking if the Best Payments Plugin for WP version is 4.6.27 or below. Inspect WordPress installations for the plugin and verify the version. Use commands like 'wp plugin list' in WP-CLI or check the plugin details in the WordPress admin panel.

Impact Analysis

Attackers can exploit this to inject scripts that steal visitor data or hijack accounts. Successful exploitation requires a privileged user to interact with a malicious link, crafted page, or form submission. The impact includes potential data theft and account compromise.

Compliance Impact

Stored XSS vulnerabilities like this can lead to unauthorized data access, which may violate GDPR's data protection requirements if personal data is compromised. For HIPAA, if the plugin handles protected health information, exploitation could result in breaches of confidentiality.

Mitigation Strategies

Immediately update the Best Payments Plugin for WP to version 4.6.28 or later. If updating is not possible, apply mitigation rules provided by Patchstack or disable the plugin until an update is available.

Hi! I’m here to help you understand CVE-2026-108484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70