The Paypal Donation Shortcode plugin stored user‑supplied content from the 'title' and 'text' parameters into posts without proper sanitization, allowing an attacker who can author or edit content to inject executable JavaScript. When a victim opens a page that contains the injected shortcode, the code runs with the visitor’s browser context, enabling theft of session cookies, credential phishing, or defacement. This flaw corresponds to CWE‑79, a classic stored XSS vulnerability.

The vulnerability affects all WordPress installations running versions of the coenjacobs:Paypal Donation Shortcode plugin up to and including 0.1. Users of the plugin, whether as site admins or contributors with write access, are at risk if they have not updated beyond 0.1.

The flaw carries a CVSS score of 6.4, placing it in the medium–high range, and has an EPSS score of less than 1 %, indicating a low but non‑zero likelihood of exploitation in the wild. The exploit requires authenticated contributors or higher with permissions to insert or edit posts, making it a privilege‑based attack. The vulnerability is not listed in the CISA KEV database, and no public exploitation campaigns have been reported.