A stored cross‑site scripting flaw exists in the Scott Paterson Contact Form 7 – PayPal & Stripe Add‑on plugin that allows an attacker to place malicious code into data fields that are later rendered on the site’s web pages. An attacker could use this to run arbitrary JavaScript in the context of the site’s visitors, enabling session hijacking, cookie theft, defacement or the spreading of malware. The vulnerability is characterized by CWE‑79 and has a moderate CVSS score of 5.9.

The vulnerability affects the Contact Form 7 – PayPal & Stripe Add‑on plugin version 2.3.4 and earlier; any WordPress installation using these versions is at risk. The plugin is distributed by Scott Paterson and is commonly referenced in WordPress repositories and third‑party marketplaces.

The EPSS score of less than 1% suggests a low probability of exploitation in the wild at the time of this analysis, and the vulnerability is not listed in CISA KEV. The likely attack vector is through the plugin’s form fields that store user‑supplied data and render it without proper neutralization. An attacker would need to submit crafted input into any available form hosted by the plugin; the payload would then be persisted in the database and served to all users who view the affected page.