An improper neutralization of user input during page generation, identified as CWE-79, is present in the Payment Form for PayPal Pro plugin up to version 1.1.72. The flaw permits an attacker to store malicious script content that is subsequently rendered in affected pages, causing the script to run in the browsers of anyone who views those pages.

All WordPress sites running the codepeople Payment Form for PayPal Pro plugin at any version through 1.1.72 are vulnerable. This includes any installation that has not yet upgraded beyond that release and likely any earlier release as well, since the advisory indicates the issue exists in every release up to the listed version.

The CVSS score of 5.9 rates the vulnerability as medium severity, and the EPSS score of less than 1% indicates a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation is documented at present. The attack path is via any form input that the plugin accepts and preserves for display; an attacker can inject script into such fields which will then be rendered to other users.