CVE-2026-61960

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.

An attacker can inject malicious scripts into pages viewed by other users, potentially leading to session theft or account takeover.

Update the WP Full Stripe Free plugin to the latest version that fixes this vulnerability.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.