A stored cross‑site scripting vulnerability exists in the Paypal Payment Shortcode WordPress plugin, triggered by the 'buttom_image' attribute of the [paypal-shortcode] shortcode. Because the plugin does not sanitize or escape this parameter, an authenticated user with Contributor-level access can embed arbitrary JavaScript that will run for any visitor to a page containing the injected shortcode. This flaw can be used to deface web content, steal cookies, hijack user sessions, or otherwise compromise the integrity of the site from the perspective of other users.

The vulnerability affects any installation of the Paypal Payment Shortcode plugin for WordPress with version 1.01 or earlier. This includes all WordPress sites that have upgraded using the plugin as of the stated release.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is < 1%, suggesting a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Exploitation requires some level of authenticated access—specifically a Contributor or higher role—to edit or add content containing the shortcode. Once the malicious code is stored, it is executed on subsequent page requests for all visitors, implying a potential compromise of confidentiality, integrity, and availability for all site users. The most likely attack path is through page or post editing features where a user can include the vulnerable shortcode.