A Cross‑Site Request Forgery flaw in the Scott Paterson Accept Donations with PayPal & Stripe plugin allows an attacker to submit a request that will store arbitrary JavaScript into the site’s content database. Once the payload is stored, it will execute in the browsers of visitors or administrators who view the affected page, potentially exposing credentials, hijacking sessions, or defacing the site. The vulnerability is categorized as CWE‑352, reflecting the missing anti‑CSRF controls that enable the malicious request. The impact is that attackers can inject and persist malicious scripts that run with the privileges of any visitor to the rendered page.

The flaw affects the WordPress plugin "Accept Donations with PayPal & Stripe" by Scott Paterson, versions up to and including 1.4.5. All installations running any version ≤1.4.5 are vulnerable.

The CVSS score of 7.1 indicates a high severity. However, the EPSS score of <1% suggests that exploitation is unlikely to be widespread under current conditions, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the stored XSS by embedding a crafted link or form that exploits CSRF, so the attack vector is remote and requires the victim to be logged in to an affected account when clicking the malicious request.