The Avishi WP PayPal Payment Button plugin for WordPress suffers from missing or incorrect nonce validation, which allows any unauthenticated user to construct a forged request that a site administrator will execute when clicking a link or performing a benign action. By using this flaw, an attacker can modify the plugin’s settings and embed malicious JavaScript, resulting in stored cross‑site scripting that is served to all visitors of the affected site. This stored script can be used to deface content, track user behavior, or redirect users to phishing sites.

The affected product is the Avishi WP PayPal Payment Button plugin distributed by Avishika, with all releases up to and including version 2.0. Administrators running any of these versions on a WordPress installation are vulnerable.

With a CVSS score of 6.1, the vulnerability represents moderate severity, and the EPSS score of less than 1 % indicates a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog and no public exploits are known. An attacker would need to lure an administrator into submitting a crafted request, at which point the vulnerability could be used to store arbitrary scripts that affect every site user. Therefore, the risk is significant if the plugin version is still running, but exploitation probability remains low until a verified exploit appears.