The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to a stored Cross‑Site Scripting flaw that arises from insufficient sanitization of the 'form' shortcode attribute. This weakness, classified as CWE‑79, permits an authenticated contributor or higher‑privileged user to embed arbitrary JavaScript that, once the content is saved, will execute in the browser whenever any user—including administrators and editors—views the affected page. The injected script therefore threatens both the confidentiality and integrity of site content and can be leveraged for phishing, credential theft, or defacement of site pages.

WordPress sites that have installed the Quick PayPal Payments: Payment Button & Form plugin, versions up to and including 6.0.4, are affected. The vulnerability exists in all releases prior to 6.0.5, regardless of the WordPress core version, and targets the plugin’s handling of shortcode attributes.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS value of less than 1% suggests a low likelihood of exploitation in the wild. The weakness requires the attacker to be authenticated with contributor-level or higher access, so it is not exploitable by anonymous users. Nevertheless, because the payload runs for every user who views the injected content, the impact on privileged users can be significant. The vulnerability is not listed in the CISA KEV catalog, further reflecting its limited exploitation footprint, but the potential damage warrants swift remediation.