The plugin processes shortcode attributes without escaping or sanitizing them and inserts the raw values into the "name" and "amount" input fields of an HTML form. This allows an attacker who can edit these attributes to embed JavaScript that will run whenever the page containing the shortcode is viewed. The description indicates that the injected script values are stored in the database and rendered on page load, which indicates a stored XSS. Based on the description, it is inferred that an attacker could use the resulting script to hijack user sessions, steal cookies, deface pages, or redirect users to malicious sites, thereby compromising confidentiality, integrity, and availability of the site.

WordPress sites that run the Paypal Shortcodes plugin version 0.3 or earlier, developed by swergroup. Only users with Contributor or higher privileges can add or modify the problematic shortcode attributes, but once a payload is stored it affects all visitors who load the affected page.

The CVSS base score of 6.4 indicates moderate severity. The exploit requires an authenticated user with Contributor privileges and no publicly available exploit code is known. The vulnerability is not listed in the CISA KEV catalog and EPSS data is not available. Because the attack vector is limited to authenticated contributors, the likelihood of widespread exploitation is moderate, though sites that share contributor access or have compromised contributor accounts are at increased risk. The required privilege level and absence of public exploits reduce the probability of immediate exploitation, yet the impact of successful execution would be serious.