Accept Stripe Payments
Monthly
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and the EPSS score (0.15%, 4th percentile) indicates low automated exploitation likelihood.
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to craft URLs that silently redirect site visitors to arbitrary external destinations, creating a phishing vector against users who trust the legitimate domain. The vulnerability stems from unvalidated user-supplied redirect parameters in the plugin's payment flow. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.16% (5th percentile) indicates minimal observed automated exploitation at time of analysis.
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.