What is the CVSS score of CVE-2026-61960?

CVE-2026-61960 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Full Stripe Free are affected by CVE-2026-61960?

WP Full Stripe Free WordPress plugin versions 8.5.0 and below contain an unauthenticated cross-site scripting vulnerability enabling attackers to steal administrator credentials and hijack user…

How to fix or mitigate CVE-2026-61960?

Within 24 hours, conduct a complete inventory of WordPress installations to identify sites running WP Full Stripe Free version 8.5.0 or earlier and prioritize production environments. Within 7 days, disable or remove the plugin from all affected sites, as no vendor patch is currently available, and deploy Web Application Firewall (WAF) rules configured to block XSS payloads targeting the vulnerability. Within 30 days, monitor the WordPress plugin repository and vendor security advisories weekly for patch availability; upon release, execute an upgrade plan to deploy the patched version across all systems.

WP Full Stripe Free CVE-2026-61960

EUVD-2026-57968 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-m4ff-rp67-jh94

WordPress XSS Wordpress Plugin Wp Full Stripe Free Themeisle

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-accessible unauthenticated XSS with Changed scope; availability impact removed as XSS does not meaningfully disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:49 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

AnalysisAI

Unauthenticated stored or reflected Cross-Site Scripting in the WP Full Stripe Free WordPress plugin version 8.5.0 and below allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users, including administrators. Because the vulnerability carries a Changed scope (S:C in the CVSS vector), successful exploitation can affect browser sessions beyond the vulnerable plugin's own context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a meaningful risk for any WordPress site running the affected plugin.

Technical ContextAI

WP Full Stripe Free (CPE: cpe:2.3:a:themeisle:wp_full_stripe_free) is a WordPress payment plugin developed by Themeisle that integrates Stripe payment processing into WordPress sites. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause is insufficient sanitization or escaping of user-controlled input before it is rendered in an HTML context. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:A confirms network-accessible, low-complexity exploitation requiring only victim user interaction (such as visiting a crafted URL or page), with scope change indicating the injected script executes in a different security context than the vulnerable component itself - a classic reflected or stored XSS pattern in a WordPress plugin.

RemediationAI

Update WP Full Stripe Free to the first version released after 8.5.0, which Patchstack indicates contains the fix; consult the advisory at https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-5-0-cross-site-scripting-xss-vulnerability for the exact patched version number. If an immediate upgrade is not possible, consider temporarily deactivating the plugin to eliminate the attack surface, accepting the trade-off of losing Stripe payment functionality on the site. A Web Application Firewall (WAF) with XSS rules - such as those provided by Wordfence or Patchstack's own virtual patching feature - can provide a compensating control, though WAF bypass remains possible for sophisticated attackers. Restricting access to plugin-rendered endpoints via IP allowlist is not practical for public-facing payment forms.