The WordPress PayPal Donation plugin is vulnerable to stored XSS because shortcode attributes such as amount, email, title, return_url, cancel_url, ccode, and image are not sanitized or escaped. When an authenticated user with Contributor-level access or higher inserts malicious code into these attributes, the plugin interpolates the values directly into HTML output without filtering. This permits an attacker to inject arbitrary JavaScript, which will execute whenever a user views the affected page.

All WordPress sites that have installed WordPress PayPal Donation up to and including version 1.01 are affected. Site administrators and content editors with Contributor or higher privileges can exploit the vulnerability by embedding malicious shortcode attributes into posts, pages, or widgets that include the donate shortcode.

The CVSS score of 6.4 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is a web application requiring authenticated access with Contributor privileges. Once code is injected, it runs for any visitor to the page, potentially allowing attackers to deface content, steal session data, or perform phishing attacks. Based on the description, it is inferred that the impact could include unintended script execution and data exfiltration for unsuspecting users.