The vulnerability is a stored cross‑site scripting flaw in the Tamara Checkout WordPress plugin, versions earlier than 1.9.9.1. It allows an attacker to embed malicious JavaScript that is permanently stored in the plugin’s data and executed in the browser of any user who views the affected content. The primary impact is the execution of arbitrary scripts in the victim’s browser. The weakness is classified as CWE-79.

The affected product is the Tamara Checkout plugin for WordPress. Versions from the earliest available release up to, but not including, 1.9.9.1 are vulnerable. No other vendors or products are listed.

The CVSS base score is 6.5, indicating a medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s input fields that persist data, and an attacker could exploit it by submitting crafted content that is stored and later rendered.