The Sell BTC – Cryptocurrency Selling Calculator plugin for WordPress contains a stored cross‑site scripting vulnerability in the orderform_data AJAX action in all releases up to and including 1.5. Because the input is not properly sanitised and the output is not escaped, an unauthenticated attacker can store arbitrary JavaScript in order records, which will run whenever a WordPress administrator opens the Orders page. The vulnerability is not limited to authenticated users and can be triggered by any visitor to the site.

Any WordPress installation that has the hayyatapps Sell BTC – Cryptocurrency Selling Calculator plugin installed with a version less than or equal to 1.5 is affected. The vulnerability specifically involves the plugin’s order handling functionality and the orderform_data AJAX endpoint.

The CVSS v3.1 base score is 7.2, indicating a high impact. The EPSS score is under 1 %, meaning the likelihood of exploitation is currently low but not zero. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely without authentication by sending a specially crafted AJAX request to orderform_data, which writes malicious script to the database. When the administrator later views the Orders page, the stored script executes in the admin context. The low EPSS suggests a moderate threat status, yet the potential for privilege escalation warrants proactive remediation.