PayPal has fixed a vulnerability that could have been exploited by attackers to deliver malicious images through the payment pages of the website.