Improper neutralization of input during web page generation allows a stored XSS flaw in the GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin. If an attacker can inject malicious script payloads that are persisted and later rendered on web pages, those scripts will execute in the browsers of any user who views the affected content. The primary consequence is that an attacker could hijack user sessions, steal credentials, deface the site, or perform further attacks on the server or network based on the user’s privileges. The form of attack is typical for CWE‑79, a known reflection or persistence issue that can undermine confidentiality, integrity, and availability of the user experience.

The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin for WordPress, v1.6.6 and earlier, is affected. All installations using any version up to and including 1.6.6 should be treated as vulnerable.

The CVSS base score of 5.9 indicates moderate severity. The EPSS score of <1% shows exploitation is currently rare, and the vulnerability is not listed in CISA KEV. However, stored XSS can be triggered remotely by anyone who can input data into fields managed by the plugin, so an attacker with any account that can submit or edit content could exploit it. The risk is moderate, but the potential impact warrants quick remediation.