The WordPress Simple PayPal Shopping Cart plugin is vulnerable to stored cross‑site scripting through the wp_cart_button shortcode. Input attributes provided by users are not properly sanitized or escaped, allowing an authenticated contributor or higher to embed malicious scripts into the page content. When an affected page is viewed, the injected JavaScript executes in the visitor’s browser, enabling attackers to steal session cookies, deface content, or execute further malicious payloads.

Any WordPress site running the Simple PayPal Shopping Cart plugin version 5.1.3 or earlier is affected. The vulnerability applies to all installations of the plugin where the wp_cart_button shortcode is used, regardless of the theme or other plugins in place.

The CVSS score of 6.4 classifies the issue as moderate severity, while an EPSS score of less than 1 % indicates that the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been exploited on a significant scale. However, because the stored scripts run on every visitor to the injected page, the potential impact is broad. Exploitation requires only that the attacker have contributor‑level or higher access, a role that many site administrators grant, making the attack vector relatively easy for a privileged user.