TI-2026-03527 CVE-2026-4072 · GHSA-jxp3-mpj8-9vw7Cross-site scripting in tstachl WordPress PayPal DonationPriority LOW 28The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01.CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00205 · Published 2026-03-21 · No fix listed CWE-79