CVE-2026-61960
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Risk Assessment
An attacker can inject malicious scripts into pages viewed by other users, potentially leading to session theft or account takeover.
Recommendation
Update the WP Full Stripe Free plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in WP Full Stripe Free
See all- CVE-2026-62073High
The WP Full Stripe Free plugin in versions up to 8.5.6 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing access controls allow unauthorized access to functions or data.
- CVE-2026-12432Medium
The WP Full Stripe Free plugin for WordPress up to version 8.4.3 lacks authorization in the wpfs_update_failed_payment_status AJAX action. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate payment records in the database, marking successful payments as failed and overwriting error codes.
- CVE-2026-42378Medium
There is a broken authentication issue in WP Full Stripe Free versions up to 8.4.1, which may lead to unauthorized access to user accounts.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS