The Paytm Payment Gateway WordPress plugin prior to version 2.8.9 does not properly sanitize or escape data received from payment callbacks before outputting it on an administrative page. The vulnerability is compounded by a flawed integrity check that can be forged if the gateway is enabled without credentials, enabling unauthenticated attackers to store malicious scripts. These scripts execute in the session of a store administrator, leading to potential full compromise of the admin interface via Cross-Site Scripting (CWE-79).

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of a store administrator's session. This can lead to theft of sensitive information, session hijacking, and potentially full administrative control over the affected WordPress site. The CVSS 3.1 score of 7.5 reflects high impact on confidentiality, integrity, and availability.

No explicit patch or remediation link is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, it is recommended to disable the Paytm Payment Gateway plugin or ensure it is not enabled without credentials to prevent exploitation of the integrity check bypass.