The Saphali LiqPay for donate WordPress plugin contains a stored cross‑site scripting (CWE-79) flaw that allows authenticated contributors and higher roles to embed malicious scripts through the "saphali_liqpay" shortcode by supplying unsanitized attributes. Once injected, the script persists and executes on every page that includes the shortcode, potentially stealing session data, hijacking users or defacing content.

WordPress sites running the Saphali LiqPay for donate plugin up to and including version 1.0.2 are affected. Any site that uses the "saphali_liqpay" shortcode in posts, pages or widgets may host the vulnerable code.

The CVSS score of 6.4 denotes moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher and the attacker must embed the malicious shortcode; after that, all site visitors who view pages containing the shortcode become victims.