The identified weakness is an improper prevention of cross‑site request forgery that allows an attacker to inject malicious JavaScript into the PayForm plugin’s data store. Once an attacker can submit a crafted request, the script is stored and later executed in the browsers of any user who views the content, enabling session hijacking, defacement, or other client‑side attacks. The flaw falls under CWE‑352. No evidence of remote code execution or denial of service is indicated, but the impact on confidentiality and integrity of user sessions is substantial.

The PayForm plugin for WordPress, versions 2.0 and earlier, is affected. The vulnerability applies to all installations of the plugin that have not been updated to a version newer than 2.0.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score of less than 1% suggests that the probability of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve an authenticated user or a user who can trigger the vulnerable form; the attacker must send a forged request that is accepted by the plugin without proper CSRF validation.