This vulnerability in the wpecommerce Recurring PayPal Donations plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 1.8. The CVSS 3.1 score is 5.9 (medium), with an attack vector of network, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that are stored and executed in the context of users viewing affected pages. This can lead to limited disclosure of information, modification of data, and disruption of availability. However, the requirement for high privileges and user interaction reduces the likelihood and scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high privilege accounts and carefully validate and sanitize inputs related to recurring donations. Monitor for suspicious activity involving stored scripts in the affected plugin.