Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More

Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Client-Side Enforcement Of Server-Side Security, behind 1 of the records (50%). Other recurring categories include Improper Validation Of Specified Quantity In Input.

Every one of the 2 issues recorded for Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-77765

Better Payment <= 2.3.3 - Unauthenticated Payment Manipulation

Read the full analysis

Vulnerability Records

2 records
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More banner
Latestv2.4.2

Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More

WPDeveloper

Author

WPDeveloper

4.6(14)
92/100
Last Updated
2026-10-14 (11d ago)
Active Installs
5,000+
Downloads
242,032
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2021-10-26 (5y ago)

Transform your WordPress payment process with the leading plugin, Better Payment which comes with versatile payment form styles, unlimited customization, and fundraising platform. Better Payment allows you to manage your own website payments with one click, without any hassle. With seamless integration with Elementor & Gutenberg, your customers can pay through PayPal, Stripe, Paystack; skipping the long checkout process. 💳 👉Simply by clicking the pay button, customers can complete their transactions for donations, subscriptions, fundraising, membership, eCommerce products, and the list goes on. You can easily send personalized success messages to customers without any coding. Also, retrieve all the payment history instantly at any time you want. 💰 ⚙️ ELEMENTOR & GUTENBERG COMPATIBILITY Better Payment is fully compatible with Elementor & Gutenberg. You can make tweaks to the way you want to your Better Payment form. Also, you can integrate with Elementor Form and make the appearance of the payment form more stunning. ✨ CREATE CAMPAIGNS WITH CAMPAIGN BUILDER Better Payment’s Campaign Builder makes it easy to create fundraising campaigns without any hassle. You can start from scratch or simply pick a ready-made template and customize it the way you want. Whether it’s for a cause, event, or fundraising goal, you get full flexibility to build a campaign that fits your needs in just a few steps. 🔄 COLLECT RECURRING PAYMENTS ON WOOCOMMERCE IN ONE CLICK Better Payment brings WooCommerce subscriptions and recurring payments to your store through the secure Stripe gateway. Turn any regular WooCommerce product into a subscription in a few clicks, set the billing cycle you want, and let Better Payment charge your customers automatically on schedule. No separate product type is needed. You configure everything on the same product screen you already use. 🛠️ ONE-CLICK STRIPE PAYMENT INTEGRATION Better Payment lets you easily integrate your Stripe account into your website with one click. You will get a Stripe Elements Checkout option with a securely embedded feature, an on-site checkout option, etc. Additionally, Better Payment provides credit cards, American Express, Visa, Master Card, and other payment methods as ways to complete the transaction. 🔌 PAYPAL PAYMENT GATEWAY INTEGRATION Better Payment gives you another integration option; it offers a PayPal payment gateway, where you can easily connect your PayPal account and start accepting payments and donations. 🏆 COMPLETE PAYMENT DIRECTLY WITH PAYSTACK With Better Payment, you can effortlessly integrate with Paystack to donate & collect money in a quick and simple process. It is an easy process to set up a Paystack account with Better Payment. 💷 MULTIPLE CURRENCY SUPPORT You can easily set up multiple currencies in Better Payment to facilitate your customers’ complete payments in their currency, regardless of where your business is set. At present, Better Payment supports 22+ global currencies. 🎨 ONE PLUGIN WITH VERSATILE PAYMENT FORM TEMPLATES Whether you want to add a simple payment form to your website or manage donation and product payments, you can do all with Better Payment. It offers a variety of payment form styles. 🖌️ GENERAL FORM STYLES [FREE] For general purposes, you can design custom payment forms with these beautiful general layouts, showing a custom name, email, payment amount, and total payment summaries. You can adjust the height, width, margin, etc. 🖌️ DONATION FORM STYLES [PRO] Specially designed for collecting donations in one click from your website. You can add multiple payment amount buttons, custom payment amount buttons, and other additional donation, fundraising, and collecting input fields. 🖌️ WOO PAYMENT FORM STYLES [PRO] Better Payment can be integrated with Woo and collect product payments for available ones. You can pick the product for which you want to make a one-click payment by selecting Woo as the source. You can design and customize the payment forms’ appearance easily. 🖌️ SUBSCRIPTION FORM STYLES [PRO] Enable recurring payments in your payment form and manage subscriptions seamlessly for your product, service or anything. With Better Payment, you can create subscription payment forms with stunning designs and start collecting payments. 🖌️ FUNDRAISING CAMPAIGN STYLES [FREE+PRO] Create a fundraising campaign for a cause and maximize collection with stylish and user-friendly payment form layouts with Better Payment. Manage collections, showcase updates, progress – get all must-have fundraising campaign features. 🌟 POWERFUL DONATION FORMS AT YOUR FINGERTIPS 🌟 Interactive design layouts and multiple donation fundraising options come with Better Payment plugin. It is very easy to set up your website checkout with the utmost flexibility at the touch of a finger. 🛍️ MANAGE WOOCOMMERCE PAYMENTS EASILY If you have an online store built with WooCommerce, then you can create separate purchase forms for each product and place them anywhere you want on your website. Collect WooCommerce payments seamlessly. 📧CUSTOM EMAIL NOTIFICATION Better Payment allows you to send a notification email to both admin and customer with each transaction. Admin notice email: You can use the ready admin email template and send email notifications to customers for each transaction. You can add additional headers, shortcodes, etc. Customer notice email: Customer email address will be auto-populated from the payment form. This email will be used to send email notifications for each transaction. Here you can also add details, shortcodes, etc. 💸 TRACK EVERY PAYMENT TRANSACTIONS Better Payment comes with a list of transaction pages for all transactions. This payment plugin has an advanced filter to search transactions based on transaction ID, email, amount, source, and payment dates. 🧾 GENERATE TRANSACTION INVOICES Send invoices to customers for every transaction they made. One can get invoices via email or print or download PDFs from Better Payment. Data fetched from payment every step will be previewed there. ⏬ EXPORT & IMPORT PAYMENT TRANSACTIONS Better Payment provides you with a one-stop solution for storing all payment transactions. You can import transactions from other places and export files as well in CSV format. 🥳 DESIGN ERROR & SUCCESS MESSAGE After every transaction, whether it is a success or something wrong happened – you can notify your customer directly from your website by designing a custom ‘Thank You’ message, success message with logo, error message, etc. 🔁 MANAGE SUBSCRIPTIONS [PRO] Build a unique type of membership site, subscriber site with Better Payment Subscription feature. Better Payment offers direct Stripe integration with its payment forms. So, you can easily create a subscription form, collect subscriptions, check the status and many more. 💹 BUILT-IN PAYMENT ANALYTICS [PRO] Clear and short report or analytics on any type of Better Payment transaction that shows total, completed, and in-progress transactions. Also, you can keep track of refunded ones from here as well. ⚡ COMING SOON Better Payment reign doesn’t stop here; more advanced and exclusive features are coming soon. Have a glimpse of the Better Payment roadmap here. Advanced email templates Coupon management New payment forms layouts 🙌 After reading this feature list, you can probably imagine that Better Payment is the best WordPress payment plugin on the market. So, do you want to unlock the advanced features? Upgrade to our Pro version. 🔥 WHAT’S NEXT Consider checking out our other WordPress solutions & boost your WordPress website: 🔝 Essential Addons For Elementor – Most popular Elementor extensions with 2 million+ active users in the WordPress repository. 🔔 NotificationX – Best Social Proof & FOMO Marketing Solution to increase conversion rates. 📄 EmbedPress: Easiest WordPress embedding plugin to add content from 250+ sources with one-click. Works in Gutenberg, Elementor, and more. ⏰ SchedulePress – Complete solution for scheduling WordPress posts through an editorial calendar & social share. Visit WPDeveloper to learn more about how to do better in WordPress with Help Tutorial, Tips & Tricks. 💙 LOVED BETTER PAYMENT? Join our Facebook Group Or rate us on WordPress. 😊 External services Better Payment connects to the third-party services below. Each one is used only for the purpose described. No data is sent to a service until you turn on the feature that needs it. Stripe Processes card payments for the payment form widget and block, Elementor Form actions, fundraising campaigns and the WooCommerce gateway. When: a visitor pays with Stripe, the visitor returns from Stripe Checkout, a WooCommerce subscription renews, or you open the payment settings (to look up a Stripe product or price you entered). A form whose amount comes from a Stripe price also reads that price from Stripe each time a visitor views the page, to show it. What is sent to api.stripe.com: the amount, currency, product or price ID, payment description, the payer’s email address and name when the form collects them, the order ID, the return URLs and your Stripe secret key (as authentication). For WooCommerce subscriptions, the saved payment method ID is sent to charge each renewal. Stripe.js is loaded from js.stripe.com on every page that shows a Better Payment payment form, a User Dashboard or an Elementor form with a Better Payment payment action, and on the WooCommerce order payment page when a customer pays with the Better Payment gateway. It loads on those pages even when Stripe is not enabled in the settings. The browser sends Stripe the visitor’s IP address and browser details, as with any web request. Terms of service: https://stripe.com/legal/ssa Privacy policy: https://stripe.com/privacy PayPal Processes PayPal payments for the payment form widget and block, Elementor Form actions and fundraising campaigns. When: a visitor pays with PayPal, and when PayPal sends a payment notification (IPN) to your site. What is sent: the visitor is redirected to www.paypal.com (or www.sandbox.paypal.com in test mode) with the amount, currency, item name, order ID, your PayPal business email and the return URLs. Each IPN message PayPal sends is posted back unchanged to ipnpb.paypal.com (or ipnpb.sandbox.paypal.com) to confirm that PayPal sent it. Terms of service: https://www.paypal.com/us/legalhub/useragreement-full Privacy policy: https://www.paypal.com/us/legalhub/privacy-full Paystack Processes Paystack payments for the payment form widget and block, Elementor Form actions and fundraising campaigns. When: a visitor pays with Paystack, and when the visitor returns from Paystack to confirm the payment. What is sent to api.paystack.co: the amount, currency, the payer’s email address, the payment reference, the return URL and your Paystack secret key (as authentication). Terms of service: https://paystack.com/terms Privacy policy: https://paystack.com/privacy/merchant AI providers (OpenAI, Anthropic, Google Gemini, OpenRouter) The optional AI Assistant in the Campaign Builder writes and edits campaign pages. It is off by default. It works only after an administrator turns it on, chooses a provider and enters their own API key in Settings. Only the provider you choose is contacted. When: an administrator sends a request from the Campaign Builder’s AI Assistant (generate, edit, analyze, refine a brief or generate an image). Site visitors never trigger it. What is sent: the administrator’s request text, the current campaign’s layout, text and settings, the site’s currency, and your API key (as authentication). No payment, transaction or customer data is sent. Generated images: the plugin downloads the image from the address the provider returns (the provider’s own file storage) and saves it to your Media Library. OpenAI (api.openai.com) — Terms of use: https://openai.com/policies/terms-of-use — Privacy policy: https://openai.com/policies/privacy-policy Anthropic (api.anthropic.com) — Commercial terms: https://www.anthropic.com/legal/commercial-terms — Privacy policy: https://www.anthropic.com/legal/privacy Google Gemini (generativelanguage.googleapis.com) — Terms of service: https://ai.google.dev/gemini-api/terms — Privacy policy: https://policies.google.com/privacy OpenRouter (openrouter.ai) — Terms of service: https://openrouter.ai/terms — Privacy policy: https://openrouter.ai/privacy Google Fonts The payment form and fundraising campaign styles, the admin screens and the email receipt template load their fonts from Google Fonts. In the block editor, a Google font chosen in a Better Payment block’s typography settings is loaded the same way. When: a page that shows one of these styles is opened, an email receipt is opened in an email client, or a Google font is chosen or shown in the block editor. What is sent to fonts.googleapis.com and fonts.gstatic.com: the request for the font file, which includes the visitor’s IP address and browser user agent, as with any web request. Terms of service: https://developers.google.com/fonts/terms Privacy policy: https://policies.google.com/privacy YouTube The Better Payment dashboard in wp-admin has a product video. When: only when an administrator clicks the video to play it. Nothing loads before that click. What is sent to www.youtube-nocookie.com (YouTube’s privacy-enhanced mode): the request for the video player, which includes the administrator’s IP address and browser details. YouTube sets no cookies until the video plays. Terms of service: https://www.youtube.com/t/terms Privacy policy: https://policies.google.com/privacy Gravatar The User Dashboard shows the logged-in user’s avatar through WordPress’s own avatar functions, which use Gravatar. When: a logged-in user views a page with the User Dashboard, or an editor previews the User Dashboard block. Only while avatars are switched on in Settings → Discussion → Show Avatars. What is sent to secure.gravatar.com (or a gravatar.com host): a hash of the user’s email address, with the visitor’s IP address and browser details. Terms of service: https://wordpress.com/tos/ Privacy policy: https://automattic.com/privacy/ WPDeveloper usage tracking (WP Insights) Optional usage statistics that help us keep the plugin compatible with other plugins and themes. It is off until an administrator chooses “Proceed To Next Step” on the first screen of the setup wizard. Choosing “Skip It” sends nothing. When: only after an administrator opts in. Once right away when they choose “Proceed To Next Step”, then once a day, and once when the plugin is deactivated. The daily send does not run while Better Payment Pro is active. What is sent to send.wpinsight.com: your site URL and name; WordPress, PHP and server software versions; language, charset, text direction and whether the site is a multisite; your active plugins and theme, and how many plugins are inactive; the Better Payment version; a site ID the service assigns; which Better Payment widgets, blocks, campaign elements, features and gateways you use; and the email address of the administrator who opted in (or the site’s admin email), to send the discount coupon. On deactivation it also sends the reason chosen in the optional deactivation form. No payment or transaction data, customer details, API keys, server file paths or inactive plugin names are sent. Terms and conditions: https://wpdeveloper.com/terms-and-conditions/ Privacy policy: https://wpdeveloper.com/privacy-policy/ Source code The JavaScript and CSS files in assets/ are compiled with @wordpress/scripts (webpack). Their human-readable source ships with the plugin, in the src/ directory: src/admin/ — the React admin screens and the setup wizard src/campaign-builder/ and src/campaign-list/ — the Campaign Builder src/blocks/ — the Gutenberg blocks src/js/ and src/css/ — the front-end scripts and styles

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C