This vulnerability (CWE-79) in 'Accept Donations with PayPal & Stripe' plugin allows an authenticated contributor-level user to inject malicious scripts due to improper input sanitization during web page generation. The CVSS 3.1 score is 6.5 (medium), with attack vector network, low attack complexity, privileges required at the contributor level, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to cross-site scripting attacks that may allow an attacker with contributor privileges to execute arbitrary scripts in the context of the affected site. This can result in limited confidentiality, integrity, and availability impacts, such as session hijacking, defacement, or other malicious actions within the scope of the contributor's permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level user access and avoid interacting with untrusted content. Monitor vendor channels for updates and apply patches promptly once available.