The ChillPay WooCommerce payment gateway plugin contains a stored cross‑site scripting flaw that arises from improper neutralization of user input during web page generation. Malicious script code can be saved in the plugin’s data store and later executed in a user’s browser when the affected page is rendered, enabling the attacker to run arbitrary client‑side code against any visitor of the site.

All installations of the WordPress ChillPay WooCommerce plugin up to and including version 2.5.3 are affected. No earlier specific versions are identified, so any site running a vulnerable version before 2.5.4 suffers this flaw.

The CVSS score of 7.1 indicates a moderate‑to‑high severity, while the EPSS score of less than 1 % suggests a low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly defined in the CVE data; based on the nature of the flaw it is inferred that the stored XSS could be triggered through the plugin’s input mechanisms or administrative interfaces that persist user-controlled data.