The vulnerability is a stored cross‑site scripting flaw that allows an attacker to embed malicious script code into a web page served by the Easy PayPal Buy Now Button plugin. The flaw arises from improper neutralization of user input during web page generation, and is classified as CWE‑79. When exploited, the injected script runs in the context of any site visitor that loads the affected page, enabling session hijacking, credential theft, or malicious page redirection. The damage potential is limited to confidentiality and integrity of data accessed through the victim’s browser, and does not directly provide system‑wide code execution.

The issue affects the Scott Paterson Easy PayPal Buy Now Button WordPress plugin. All releases up to and including version 2.0 are vulnerable; the plugin has no earlier version that implements the fix.

The CVSS score of 5.9 indicates a medium severity that can affect multiple users through a single exploitation. The EPSS score of less than 1% suggests that large‑scale automated attacks are unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector is a user or administrator interacting with the plugin’s form or settings interface, which stores unsanitized input. In the absence of additional mitigations, any visitor who loads the stored data after injection can be affected.