The vulnerability allows authenticated users who can edit payment forms to insert arbitrary HTML into the Help Text field of the GetPaid plugin. The stored malicious HTML is rendered in the browser when the form is viewed, enabling cross‑site scripting that could deface pages, steal session cookies, or load malicious scripts. The weakness corresponds to improper input validation that permits HTML content.

The GetPaid plugin for WordPress, specifically version 2.4.6, is affected. The plugin is used in WordPress installations that provide invoicing and payment forms. No other versions are listed as vulnerable.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with the capability to edit payment forms; therefore the attack surface is limited to users who have appropriate administrative permissions. Despite the authentication requirement, the impact on end‑user browsers is significant because injected HTML is executed automatically when the form is displayed. Given the combination of moderate CVSS, lack of exploit data, and restricted attack vector, the immediate risk is moderate but mitigated by applying the official patch.