The vulnerability allows an attacker to store malicious script code in the plugin’s data, which is then rendered in a web page without proper neutralization. When a victim visits a page generated by the plugin, the injected script executes in the victim’s browser. This can lead to cookie theft, session hijacking, or arbitrary content injection, thereby compromising the integrity and confidentiality of user sessions.

The flaw affects the vcita Online Payments – Get Paid with PayPal, Square & Stripe WordPress plugin, versions from the earliest available build up through 3.20.0. The plugin is used to embed PayPal, Square, and Stripe payment buttons on WordPress sites.

The CVSS score of 6.5 indicates a moderate severity. With an EPSS score of less than 1%, the likelihood of public exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw is a stored XSS and can be triggered via normal user input fields in the plugin, any user who visits a compromised page could be affected. The attack vector is inferred to be remote, through the web interface, and the impact includes potential session hijacking, defacement, and credential theft.