The vulnerability is a stored cross‑site scripting flaw in the Stiofan GetPaid plugin that arises when the plugin does not properly neutralize user input before persisting it to the database and subsequently rendering it on web pages. An attacker can inject arbitrary JavaScript that will execute in the browsers of visitors who view the affected pages, potentially leading to session hijacking, credential theft, or defacement of displayed content. This weakness aligns with CWE‑79, where unsanitized input is reproduced on output.

The WordPress GetPaid invoicing plugin from Stiofan, versions from unspecified releases through 2.8.62, is affected. Site owners who have any of those releases installed are susceptible to the stored XSS flaw.

The CVSS score of 7.1 indicates a medium‑to‑high severity. No EPSS data is available, so the contemporary exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the plugin’s administrative interface, where an attacker submits crafted input that is stored and later served unfiltered to visitors. While publicly disclosed exploits are not known, the absence of EPSS does not preclude exploitation on high‑traffic sites, making the current threat moderate with the potential to intensify if attackers target vulnerable deployments.