Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-ecommerce-paypal
Easy PayPal Buy Now Button
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 2, 2026Easy PayPal & Stripe Buy Now Button: Does not derive the payment amount on the serverCVE-2026-90987 · fixed in 2.0.6 · reported by WPScanMedium 5.3
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · affects up to 2.0.4 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
May 7, 2025Easy PayPal Buy Now Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47623 · affects up to 2.0 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.
Aug 19, 2024Easy PayPal Buy Now Button: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43236 · affects up to 1.9 · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request Forgery (CSRF)CVE-2023-51683 · affects up to 1.8.1 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
Feb 13, 2023Easy PayPal Buy Now Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4628 · fixed in 1.7.4 · reported by WPScanMedium 5.4
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.