Stripe Payments
Monthly
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated bypass in the Stripe Payments WordPress plugin (versions up to and including 2.0.98) allows remote, unauthenticated attackers to circumvent authentication controls, resulting in limited confidentiality and integrity impact against affected WordPress installations. Reported by Patchstack (ENISA EUVD-2026-36838), the flaw is classified under CWE-440 (Expected Behavior Violation), indicating the plugin's actual enforcement diverges from its intended or documented security model. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated bypass in the Stripe Payments WordPress plugin (versions up to and including 2.0.98) allows remote, unauthenticated attackers to circumvent authentication controls, resulting in limited confidentiality and integrity impact against affected WordPress installations. Reported by Patchstack (ENISA EUVD-2026-36838), the flaw is classified under CWE-440 (Expected Behavior Violation), indicating the plugin's actual enforcement diverges from its intended or documented security model. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.