Stripe Payments EUVD-2026-65176

No attacker-side authentication is required (PR:N per CVSS), and no special server configuration or non-default plugin settings are described as necessary - the plugin in its default installed state on any WordPress site running version 2.1.2 or earlier is sufficient for exposure. The sole required condition is user interaction (UI:R): a victim must click a crafted link or navigate to a page containing the injected payload, making the attack dependent on a social engineering or delivery mechanism. The Scope:Changed metric confirms the injected script executes in the victim's browser context, not on the server. Limiting factors for real-world exploitation include the need to identify target sites running the specific vulnerable plugin version and the requirement to deliver the crafted URL to a victim - these constraints reduce automatable mass exploitation but do not protect against targeted or semi-automated campaigns.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-exploitable, low-complexity, unauthenticated XSS with changed scope and mixed low-severity impacts across confidentiality, integrity, and availability. The PR:N vector confirms no attacker-side authentication is required, substantially lowering the exploitation barrier for a plugin that may be publicly accessible on any WordPress e-commerce site. The sole technical limiting factor is UI:R - the attack depends on delivering a crafted URL to a victim, reducing fully-automated mass exploitation compared to server-side flaws. No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified numerically; however, unauthenticated XSS in payment-processing plugins historically attracts opportunistic campaigns targeting admin session tokens and payment-related credentials. KEV status is not confirmed and no POC has been identified at time of analysis, indicating this is not currently subject to documented widespread active exploitation. The payment-processing context elevates practical risk meaningfully above what the numeric score alone conveys - operators running this plugin on production sites handling cardholder data should treat remediation as a near-term priority rather than routine patching.

An attacker crafts a malicious URL embedding an XSS payload in a vulnerable parameter handled by the Stripe Payments plugin and distributes it to WordPress site administrators or customers via phishing email or social media. When the victim clicks the link while authenticated, the injected script executes in their browser under the site's origin, enabling cookie exfiltration or authenticated actions on the victim's behalf. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw means exploitation requires minimal skill once the vulnerable parameter is identified.