Contributor Cross Site Scripting (XSS) flaw found in the WordPress Accept Donations with PayPal & Stripe plugin up to version 1.5.5. The defect results from the plugin not properly escaping data submitted by contributors, allowing arbitrary JavaScript to execute in the browsers of site visitors. This can compromise the confidentiality and integrity of user sessions and erode user trust. No server‑side code execution is provided directly by the vulnerability.

The plugin delivered by Scott Paterson, titled Accept Donations with PayPal & Stripe, is affected on WordPress sites running any version 1.5.5 or earlier. Version 1.5.6 and later include the fix, so sites using this plugin should verify they are running the patched version.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score is less than 1 %, indicating a very low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. It is a client‑side issue; based on the description, the likely attack vector involves an attacker injecting malicious script into a donation page or form that a user visits, such as through phishing or by modifying content on a trusted page. No privileged server access or direct remote code execution on the server is required.