Mra13
Monthly
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting (XSS) in Simple Shopping Cart WordPress plugin versions up to 5.2.4 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsc_display_product' shortcode attributes due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages. No public exploit code or active exploitation has been reported at time of analysis.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting (XSS) in Simple Shopping Cart WordPress plugin versions up to 5.2.4 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsc_display_product' shortcode attributes due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages. No public exploit code or active exploitation has been reported at time of analysis.