A Stored Cross-Site Scripting vulnerability in the Autopay plugin for WordPress allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

This is a Stored Cross-Site Scripting (CWE-79) vulnerability where the plugin fails to sanitize input properly. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector's PR:N (Privileges Required: None) attribute.

Successful exploitation allows an attacker to inject malicious scripts into the web application, which can lead to session hijacking, unauthorized actions on behalf of the victim, or the redirection of users to malicious sites. With a CVSS score of 7.2, this vulnerability represents a significant security risk, as it compromises the integrity and confidentiality of the user interface.

Immediate Action: Update the Autopay plugin to version 5.0.1 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review web access logs for unusual traffic patterns or suspicious injection attempts directed at plugin-related files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in incoming requests.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of Stored XSS, administrators should prioritize updating the Autopay plugin immediately. Failure to patch may expose users and administrative sessions to malicious script execution.