This vulnerability in the Enhanced Paypal Shortcodes plugin allows stored cross-site scripting due to improper input sanitization during web page generation. Attackers can inject malicious scripts that persist and execute in the context of other users viewing affected pages. The CVSS score of 6.5 reflects a medium severity with network-based attack requiring some privileges and user interaction, impacting confidentiality, integrity, and availability. No patch or remediation details are currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The medium severity score reflects these risks but also notes the requirement for privileges and user interaction, which may limit exploitability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the affected plugin version. Monitor official channels for updates and apply patches promptly once released. No vendor advisory or official fix information is currently provided.