The VNPAY Payment gateway plugin for WordPress is vulnerable to a reflected cross‑site scripting flaw that arises from insufficient input sanitization and output escaping applied to the 'message' parameter. An unauthenticated attacker can craft a malicious URL containing JavaScript payloads; when a victim clicks the link, the payload is reflected back and executed in the victim’s browser. This enables the attacker to run arbitrary client‑side code, which can be used for session hijacking, data theft, or defacement.

The vulnerability affects all versions of the VNPAY Payment gateway for Woocommerce released by teyldoan up to and including version 1.0.0. No later releases are covered by the description.

The flaw carries a CVSS score of 6.1, indicating moderate severity, and an EPSS score of less than 1 %, implying a very low exploitation probability under current conditions. It is not listed in the CISA KEV catalog. The attack requires no authentication but does require a victim to visit a crafted link—making it a user interaction‑based, reflected XSS vector that can be executed in any browser that renders the vulnerable page.