CVE-2026-78282
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
Risk Assessment
An attacker could inject malicious scripts into web pages, potentially leading to theft of user data, session hijacking, or other attacks.
Recommendation
It is recommended to immediately update the Stripe Payments plugin to a version newer than 2.1.2 that includes a fix for this vulnerability.
Other vulnerabilities in Stripe Payments
See all- CVE-2026-42752Medium
Versions of Stripe Payments up to 2.0.98 contain a vulnerability that allows for unauthenticated bypass.
- CVE-2021-47983Medium
WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.