The vulnerability resides in the ThemeMakers PayPal Express Checkout WordPress plugin, where the 'paypal' shortcode accepts user‑supplied attributes without adequate sanitization or escaping. This flaw allows an authenticated contributor or higher to embed malicious JavaScript code that is stored and served to any visitor of pages using the shortcode. The result is a stored cross‑site scripting condition capable of stealing session cookies, defacing site content, or redirecting users to malicious sites.

Affected systems are all installations of the ThemeMakers PayPal Express Checkout plugin for WordPress running version 1.1.9 or earlier. The plugin is commonly used in themes such as Car Dealer Automotive, and any user with contributor‑level access or higher can exploit the flaw by inserting a malicious shortcode into a page or post.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access, so attackers must first compromise user credentials or gain contributor privileges. Once authenticated, the attacker can craft a malicious shortcode that, when embedded in a post or page, will execute on visitors’ browsers.