CVE-2025-12834
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Analysis
Reflected cross-site scripting (XSS) in Accept Stripe Payments Using Contact Form 7 WordPress plugin versions up to 3.1 allows unauthenticated attackers to inject arbitrary JavaScript via the 'failure_message' parameter due to insufficient input sanitization and output escaping. An attacker can craft a malicious link that, when clicked by a victim, executes JavaScript in the victim's browser session with access to sensitive data or session tokens. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical Context
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw. The Accept Stripe Payments Using Contact Form 7 plugin, which integrates Stripe payment processing with Contact Form 7, fails to properly sanitize and escape the 'failure_message' parameter before outputting it in HTML context. The vulnerable code path is in class.cf7sa.lib.php (line 696 per the plugin repository reference), where user-supplied input is reflected directly into the page response without adequate sanitization via functions like sanitize_text_field() or escaping via wp_kses_post(). WordPress plugins must follow strict output escaping practices (esc_html(), esc_attr(), wp_kses_post()) to prevent XSS, particularly for parameters exposed in URLs or form submissions.
Affected Products
The Accept Stripe Payments Using Contact Form 7 WordPress plugin is affected in all versions up to and including 3.1. This plugin extends Contact Form 7 to accept Stripe payments and is distributed through the official WordPress plugin repository (https://plugins.trac.wordpress.org/browser/accept-stripe-payments-using-contact-form-7/). Wordfence reported the vulnerability with reference ID d9e77e3f-dcd8-426a-be0f-24eb65c6709e, and the plugin repository references changeset 3418155 and line 696 of class.cf7sa.lib.php as the vulnerable code location.
Remediation
Update the Accept Stripe Payments Using Contact Form 7 plugin to a patched version released after 3.1. The WordPress plugin repository changeset 3418155 indicates a fix has been committed; install the latest available version of the plugin via WordPress admin dashboard (Plugins > Updates) or manually download the patched version from https://plugins.trac.wordpress.org/. Ensure the 'failure_message' parameter and all user-controlled input is properly sanitized using WordPress sanitization functions (sanitize_text_field(), sanitize_textarea_field()) on input and escaped using appropriate escaping functions (esc_html(), esc_attr(), wp_kses_post()) on output before rendering in HTML. As an interim mitigation, disable the plugin if not actively required, or restrict access to payment pages via IP whitelisting or authentication until patched. For additional guidance, reference Wordfence's vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today