CVE-2025-1689 is a stored cross-site scripting vulnerability in the ThemeMakers PayPal Express Checkout plugin for WordPress, affecting versions up to and including 1.1.9. The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the 'paypal' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users visiting the compromised pages. This can lead to limited confidentiality and integrity impacts but does not affect availability.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via the 'paypal' shortcode. These scripts execute in the browsers of users who visit the injected pages, potentially leading to limited confidentiality and integrity breaches such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on system availability. No known exploits in the wild have been reported.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level permissions to trusted users only and consider disabling or removing the ThemeMakers PayPal Express Checkout plugin if possible to mitigate risk.