The plugin contains a stored cross‑site scripting flaw that can be triggered by unauthenticated users. The 'approval_code' parameter is accepted and persisted without proper sanitization or output escaping user views an affected page, enabling phishing, credential theft, or other malicious client‑side actions. The weakness is classified as a cross‑site scripting issue (CWE‑79).

All installations of the CorvusPay Woo up to and including version 2.7.4 on WordPress sites are vulnerable. The flaw exists across the plugin’s REST endpoint and related order handling modules.

The CVSS score medium‑to‑high severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, the attack vector is straightforward: any unauthenticated user can POST to the /wp-json/corvuspay/success/ endpoint and supply a malicious signature, leading to the storage of a script that will execute in the context of subsequent page loads for other users. Because the signature validation step does not halt execution, attackers do not need privileged access to exploit the flaw.