This vulnerability in the Easy PayPal Buy Now Button plugin (<= 2.0) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction could inject malicious scripts that may lead to partial confidentiality, integrity, and availability impacts. The vulnerability is network exploitable with low attack complexity but requires privileges and user interaction.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates that the attacker must have high privileges and user interaction is required, which limits the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to this plugin. Avoid using affected versions of the Easy PayPal Buy Now Button plugin if possible.