The 'Accept Donations with PayPal & Stripe' WordPress plugin suffers from a reflected cross-site scripting vulnerability (CWE-79) via the 'rf' parameter. This occurs because the plugin fails to properly neutralize input during web page generation, allowing injection of arbitrary web scripts. The vulnerability affects all versions up to 1.4.4. Exploitation requires user interaction, such as clicking a crafted link, and can lead to script execution in the victim's browser. The CVSS 3.1 base score is 6.1 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website for users who click on a malicious link. This can lead to information disclosure or manipulation of user interactions on the site. There is no indication of impact on system availability. The vulnerability affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the 'rf' parameter in this plugin. Consider disabling or removing the plugin if possible or applying custom input sanitization and output escaping as a temporary mitigation.