All packages
WP Full Stripe Free vulnerabilities
3 known CVE vulnerabilities in WP Full Stripe Free, translated and rated.
- CVE-2026-61960High
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
- CVE-2026-12432Medium
The WP Full Stripe Free plugin for WordPress up to version 8.4.3 lacks authorization in the wpfs_update_failed_payment_status AJAX action. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate payment records in the database, marking successful payments as failed and overwriting error codes.
- CVE-2026-42378Medium
There is a broken authentication issue in WP Full Stripe Free versions up to 8.4.1, which may lead to unauthorized access to user accounts.