The vulnerability is an open redirect that allows an attacker to craft URLs which redirect users to arbitrary external sites. The flaw is a classic CWE‑601 weakness where user input is passed to a redirect function without proper validation, enabling phishing attempts.

Scott Paterson Accept Donations with PayPal & Stripe plugin is affected for all releases up to and including 1.5.2. Any site using a version from its earliest release through 1.5.2 is vulnerable.

With a CVSS score of 4.7 the threat is moderate, and an EPSS score of less than 1 % suggests low current exploitation probability. The issue is not listed in CISA KEV. Attackers can exploit the flaw by sending users crafted URLs that redirect to malicious sites; the attack requires user interaction and does not grant code execution or elevated privileges.