The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 WordPress plugin contains a stored cross-site scripting vulnerability (CWE-79) in the pafw_instant_payment shortcode. This flaw arises from inadequate sanitization and escaping of user-supplied attributes, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code. The injected scripts persist in the plugin's output and execute in the context of any user who accesses the compromised page. The vulnerability affects all plugin versions up to and including 5.1.4. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts that execute in the browsers of users visiting the affected pages. This can lead to partial compromise of confidentiality and integrity, such as theft of session tokens or unauthorized actions performed on behalf of users. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for plugin updates from the vendor and apply them promptly once released.