This vulnerability is an improper neutralization of input during web page generation (CWE‑79). It allows a malicious user to store arbitrary JavaScript in the Checkout for PayPal plugin. When a victim loads a page that displays the stored content, the script runs in their browser, potentially defacing the site, stealing cookies or session tokens, or redirecting the user to a malicious site.

The flaw affects the WordPress Checkout for PayPal plugin for administrators who use the product. Versions up to and including 1.0.38 are impacted. Any site that has the plugin installed without the update is susceptible.

The CVSS score of 6.5 indicates medium severity; the EPSS score of less than 1% shows a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The stored nature means that an attacker could embed the payload in any input field that the plugin later renders, such as product descriptions or form submissions. Once an end‑user loads the malicious content, the attack executes in the context of the site, making a remote attacker’s ability to compromise a user’s session or to deface the site a realistic threat.