WPManageNinja Best Payments Plugin for WP contains a stored Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation. The vulnerability allows an attacker to inject malicious JavaScript that will execute in the browsers of other users whenever the stored data is displayed, potentially leading to defacement, cookie theft, session hijacking, or other unintended actions on the affected site.

All instances of Best Payments Plugin for WP by WPManageNinja running version 4.6.27 or earlier are vulnerable, as the issue is present from the earliest release through 4.6.27, and the fix begins with 4.6.28.

The high CVSS score of 7.1 indicates significant severity, but EPSS data is unavailable, so the probability of exploitation remains uncertain. Attackers are likely to exploit the flaw by submitting malicious data through the plugin’s input fields, which is then stored and rendered to other users. Because it is a stored XSS, any user who views the affected content can be impacted, and no special environmental prerequisites are required beyond normal plugin usage.