Based on the CVE description, the Simple Payment plugin for WordPress, versions 2.5.1 and earlier, has an unauthenticated Cross‑Site Scripting flaw. This vulnerability, classified as CWE‑79, permits attackers to inject arbitrary JavaScript into the browser of any user who views the malicious content. The flaw can be triggered through untrusted input handled by the plugin and could compromise confidentiality, integrity, or availability of the site’s content if exploited.

Any WordPress installation that has the Simple Payment plugin (developed by Ido Kobelkowsky) installed and running version 2.5.1 or older is affected. No further version filtering is available beyond the <= 2.5.1 boundary.

The CVSS score of 7.1 indicates a high potential impact, especially given the unauthenticated nature of the flaw, meaning a threat actor can potentially exploit it without authentication. Based on the description, the likely attack vector is tricking a user into visiting a maliciously crafted URL or page that triggers the plugin’s rendering logic. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. As an unauthenticated XSS vulnerability, the flaw allows execution of arbitrary JavaScript in the context of the victim’s browser session, potentially compromising confidentiality, integrity, or availability of the site’s content, although the exact impact is not explicitly stated in the CVE.