Executive brief
The Accept Stripe Payments plugin for WordPress, which allows websites to process credit card transactions, contains a security flaw. An authenticated attacker can inject malicious scripts into the plugin's settings. If an administrator views these settings, the script will execute in their browser, potentially allowing the attacker to perform unauthorized actions or compromise the site's management interface.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the WordPress Stripe Payments plugin version 2.0.39 and below. The flaw is located in the 'currency_code' parameter within the 'AcceptStripePayments-settings' group. An authenticated attacker with sufficient privileges to modify plugin options can submit a crafted POST request to /wp-admin/options.php containing a malicious JavaScript payload. Because the input is not properly sanitized before being stored and subsequently rendered in the administrative settings page, the script executes in the context of any administrator who views the plugin's configuration. This can lead to session hijacking or unauthorized administrative actions.
Affected products
- Tips and Tricks HQ (mra13) Accept Stripe Payments 2.0.39 and earlier
Timeline
- 2021-01-04: disclosed: Initial discovery and exploit publication by Park Won Seok.
- 2026-06-08: advisory: CVE published/updated in NVD.