The vulnerability is an improper neutralization of input that enables stored cross‑site scripting in the WordPress plugin. An attacker can embed malicious scripts in data stored by the plugin, which will execute in the browsers of visitors who view the affected content, allowing data theft, defacement, or session hijacking.

The affected product is the WordPress plugin for generating Iamport payment buttons, sold under the name PORTONE 아임포트 결제버튼 생성 플러그인. Versions up to and including 1.1.19 are impacted; no version information beyond that is available in the advisory.

The CVSS v3.1 score is 6.5, indicating a moderate impact. The EPSS score is less than 1%, showing a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s stored data fields; an attacker needs to inject a malicious payload that the plugin does not sanitize, which then runs when any visitor loads the page containing the stored value.