The EPay.bg Payments plugin for WordPress contains a stored cross‑site scripting flaw in the 'epay' shortcode. Unsanitized and unescaped attributes supplied by users allow malicious scripts to be embedded in the content of pages created or edited within the plugin. When anyone visits a page that displays the shortcode, the injected script runs in the victim’s browser, potentially stealing session data, modifying the page, or redirecting to phishing sites. The weakness is a classic input validation failure (CWE‑79).

WordPress sites using the EPay.bg Payments plugin version 0.1 or earlier are affected. The vendor of the plugin is Vloo, and the affected product is the EPay.bg Payments plugin, all releases up to and including 0.1. There is no newer version indicated in the available references, so any site running this version is vulnerable.

The CVSS score of 6.4 indicates a medium‑to‑high severity. The EPSS value is below 1 %, meaning that the likelihood of exploitation is currently low but not negligible. The vulnerability is not listed in CISA’s KEV catalog. It requires the attacker to have at least contributor‑level access to the site, which is an authenticated privilege. Once in, the attacker can insert scripts that execute in the context of other users who view the affected content, enabling data theft and defacement scenarios. The attack vector is therefore an authenticated web application misuse that exploits improper input handling.