CVE-2025-39572 describes a stored cross-site scripting vulnerability in the Noor Alam Checkout for PayPal plugin (versions <= 1.0.38). The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that are stored and later executed in the context of users visiting the affected pages. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited degree. No patch or official fix information is provided in the data, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, the impact is limited by the requirement for user interaction and some level of privilege. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using affected versions of the Noor Alam Checkout for PayPal plugin and consider applying any available temporary mitigations recommended by the vendor. Monitoring vendor channels for updates is advised.