The Transbank Webpay WordPress plugin before version 1.14.0 logs data without sanitizing or escaping it. When the logs are displayed in the WordPress admin area, the unsanitized content is rendered directly, allowing the injection of malicious JavaScript. This flaw satisfies the definition of a stored cross‑site scripting vulnerability (CWE‑79).

WordPress sites that run the Transbank Webpay plugin with a version older than 1.14.0 are impacted. The problem resides in the plugin’s logging component, which is accessible to anyone who can interact with the plugin’s endpoints, regardless of authentication status.

No CVSS score or EPSS value is supplied, and the vulnerability is not listed in the CISA KEV catalog, so the precise exploitation probability is unknown. However, the description indicates that unauthenticated users may inject code via the logging mechanism, which is a well‑known high‑risk vector for compromising administrator accounts when the user later views the affected logs. The lack of a known exploit reference suggests that it has not yet been widely abused, but the mechanism remains available for attackers who can identify sites running the vulnerable plugin.