The EC Authorize.net plugin for WordPress contains an improper neutralization of input during page generation, allowing attackers to inject malicious scripts into responses. When an affected victim visits a crafted URL or otherwise triggers the vulnerable input handling, the script runs in the visitor’s browser under the site’s origin, enabling session hijacking, cookie theft, defacement, or the execution of arbitrary client‑side code.

The vulnerability is present in the WordPress EC Authorize.net plugin published by SFTRANNA, affecting all releases through version 0.3.3. Any site running that plugin version is at risk regardless of underlying WordPress or server configuration.

The CVSS score of 7.1 indicates a high‑severity vulnerability, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by tricking users into visiting a malicious link or interacting with a manipulated form; the attack vector is web‑based and requires no special privileges.