The Paytm Payment Gateway WordPress plugin before version 2.8.9 fails to sanitize or escape data that is saved from payment callbacks before it is displayed on an admin page. Because the integrity check on those callbacks can be forged when the gateway is enabled without credentials, an unauthenticated user can store malicious scripts that execute in the browser session of any store administrator who views the affected admin page. This allows the attacker to steal session cookies, deface administrative interfaces, or perform other client‑side attacks. The weakness is an input validation flaw that permits stored cross‑site scripting as described by CWE-79.

Any WordPress installation that has the Paytm Payment Gateway plugin deployed with a version older than 2.8.9 is susceptible. The original description refers to "before 2.8.9", indicating that all earlier releases, regardless of minor version, are affected. Users who have upgraded to 2.8.9 or newer are not impacted. No specific vendor or operating system limitations are listed.

The vulnerability can be exploited by an attacker without authentication, provided they can reach the payment callback endpoint. The attack requires only that the attacker supply a crafted payload during a transaction, which the plugin will record and later render. Because the data is stored without sanitization, the malicious script runs in the context of the administrator's browser whenever the affected admin page is accessed. The CVSS score is 7.5, indicating high severity. The EP score is not available. The vulnerability is not listed in CISA’s KEV catalog. Therefore the available information suggests a medium to high likelihood of exploitation, especially for sites that have not applied the patch and do not enforce gateway authentication.