Checkout for PayPal
Checkout for PayPal has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Missing Authorization.
Every one of the 4 issues recorded for Checkout for PayPal has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (2) reported by Muhammad Yudha - DJ. Checkout for PayPal is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-39572Checkout for PayPal <= 1.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Checkout for PayPal
Author
Noor Alam
Checkout for PayPal is a lightweight WordPress PayPal plugin that lets you accept payments directly through PayPal’s Checkout API. Checkout for PayPal Add-ons Variable Price Contact Form 7 Integration Order Export Features PayPal Checkout – Accept payments securely through PayPal Checkout directly from your WordPress website. Accept PayPal Payments – Let customers pay with PayPal without requiring a traditional shopping cart. No WooCommerce Required – Add PayPal payment functionality without installing WooCommerce. No Shopping Cart Required – Ideal for single products, services, bookings, donations, and other direct-payment use cases. Payment Buttons – Add a payment button to pages, posts, and landing pages. PayPal Checkout API – Uses PayPal’s Checkout/Orders API to create and process PayPal orders. Secure Payment Processing – Payment details are handled by PayPal rather than stored on your WordPress website. PayPal Sandbox Support – Test your integration using PayPal’s sandbox environment before accepting live payments. Live and Sandbox Environments – Easily configure the plugin for either PayPal testing or live transactions. Simple Configuration – Configure your PayPal payment settings from the WordPress admin area. Responsive Checkout – Provide a PayPal checkout experience that works across desktop and mobile devices. Lightweight Payment Solution – Add PayPal payments without the overhead of a complete ecommerce system. Developer-Friendly Integration – Built around PayPal’s APIs for reliable integration with WordPress. Custom Amounts – Accept fixed or variable payment amounts using Variable Price add-on. How to Use the Plugin Navigate to plugin settings (Checkout for PayPal > Settings) and fill in all required fields (API keys, Page URLs, Currency). Open checkout page to make sure it contains this shortcode: [coforpaypal_checkout] Create a Product (Checkout for PayPal > Products) Create a Buy Now button for a product by adding this shortcode to a page: [coforpaypal_product id="1"] Note: You need to replace 1 with the actual product ID. Elementor Page Builder Integration Create a new page or Edit with Elementor. From Widgets (Under Elements) select Shortcode. Enter the Checkout for PayPal shortcode. Click Apply to update changes to page. Click Publish. Documentation https://noorsplugin.com/checkout-for-paypal-wordpress-plugin/ Translation If you are a non-English speaker please help translate Checkout for PayPal into your language. Note: This is NOT an official PayPal product.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C