EUVD-2026-34924
GHSA-2mcq-gv8w-446w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions up to, and including, 1.28.0. This is due to insufficient input sanitization and output escaping on the shortcode attribute value, which is concatenated into an HTML attribute in the rendered output of the register_shortcode() function without being passed through esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Express Payment For Stripe WordPress plugin (versions up to and including 1.28.0) allows authenticated contributors to permanently embed malicious JavaScript into site pages via the unsanitized 'type' attribute of the [stripe-express] shortcode. The root defect is in register_shortcode() within wp-stripe-shortcodes.php, where the attribute value is concatenated directly into an HTML attribute without passing through WordPress's esc_attr() or any equivalent escaping function. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; however, the CVSS Changed Scope (S:C) signals that successful exploitation escapes the contributor's own security context and can compromise higher-privileged users such as administrators who visit the injected page.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored variant. The affected component is the register_shortcode() function in wp-stripe-shortcodes.php (confirmed at lines L31 and L46 of the plugin's 1.28.0 tag in the WordPress plugin repository). WordPress shortcode attributes are user-supplied strings that must be sanitized on input and escaped on output; the WordPress API provides esc_attr() for HTML attribute contexts and sanitize_text_field() for input sanitization. The plugin bypasses both steps, allowing the raw 'type' attribute value from [stripe-express type='...'] to be written verbatim into a rendered HTML attribute, enabling event-handler or protocol-based XSS payloads. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N deserves scrutiny: UI:N is atypical for stored XSS, which canonically requires a victim to load the injected page (normally UI:R); this may reflect the scorer's interpretation that no attacker-side interaction is needed after payload delivery, but defenders should treat this as a victim-interaction-dependent attack in practice.
RemediationAI
A fix commit has been applied to the WordPress plugin repository (changeset https://plugins.trac.wordpress.org/changeset?old=3553233%40wp-stripe-express&new=3553233%40wp-stripe-express), indicating upstream remediation is available; however, the exact patched release version number is not independently confirmed from the available data - administrators should update to the latest available version of Express Payment For Stripe beyond 1.28.0 and verify the installed version in the WordPress dashboard. The correct developer fix is to pass the 'type' shortcode attribute through esc_attr() before concatenation into the HTML output within register_shortcode(). If an immediate update is not possible, the most targeted compensating control is to restrict the WordPress contributor role: audit all users with contributor-level access or above and remove unnecessary role assignments, as this eliminates the attacker's required privilege. Alternatively, a Web Application Firewall with a WordPress XSS ruleset (e.g., Wordfence Premium, Cloudflare WAF) can block delivery of XSS payloads via shortcode attributes; note that WAF rules may generate false positives on legitimate special characters in shortcode usage. Disabling the [stripe-express] shortcode entirely (by deactivating the plugin) eliminates the attack surface at the cost of losing payment functionality.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today