Stripe WooCommerce EUVD-2026-96220

Exploitation requires that the plugin's 'Generic Errors' setting be UNCHECKED (a non-default hardening toggle), which causes getErrorMessage() to return the raw, unsanitized Stripe error string instead of a mapped safe message; without this, the reflected sink is not reachable. The payload is delivered via the '#response' URL fragment on plugin-rendered pages, and because CVSS specifies UI:R, the attack also requires a victim to actively open the attacker-supplied link - it is not a server-side, zero-click flaw. Authentication is not required (CVSS PR:N, unauthenticated attackers). These two limiters - the operator-controlled configuration state and mandatory user interaction - meaningfully narrow realistic exploitation despite the network attack vector.

This is a moderate-severity reflected XSS (CWE-79) with a provided CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning network-reachable, no privileges required, but dependent on user interaction and limited to low confidentiality/integrity impact. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT a confirmed-exploited emergency. The practical risk is further dampened by a significant precondition the description makes explicit: exploitation only works when the site operator has UNCHECKED the 'Generic Errors' setting, causing getErrorMessage() to return raw Stripe error strings; on default configurations the mapped safe message is substituted and the sink is not reachable. This creates a real tension with the input CVSS AC:L (low complexity), because the dependence on a specific non-default configuration argues for higher attack complexity than the base score reflects. Net assessment: a legitimate but low-to-moderate priority issue - patch in normal cycles - rather than a drop-everything threat, given no exploitation signal and a configuration-gated attack surface.

An attacker crafts a malicious URL for a checkout or payment page containing a JavaScript payload in the '#response' URL fragment and lures a shopper or administrator into clicking it (e.g., via phishing or a malicious link). On a site where 'Generic Errors' is unchecked, the raw Stripe error string is reflected and the script executes in the victim's browser session, enabling session cookie theft, redirection, or UI manipulation. No public proof-of-concept exploit is identified in the provided data.