CVE-2021-47983
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.
Risk Assessment
An authenticated attacker could execute malicious script in the administrator's browser, potentially leading to admin account takeover or other malicious actions.
Recommendation
Update the Stripe Payments plugin to version 2.0.40 or later. Restrict user privileges and regularly audit plugin settings.
Other vulnerabilities in Stripe Payments
See allOriginal NVD description (English source)
WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.