Refine your search

2 vulnerabilities found for Payment Plugins for Stripe WooCommerce by paymentplugins

CVE-2026-89100 (GCVE-0-2026-89100)
Vulnerability from cvelistv5
Published
2026-10-10 06:40
Modified
2026-10-11 12:23
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 'Generic Errors' setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.
References
Impacted products
Vendor Product Version
paymentplugins Payment Plugins for Stripe WooCommerce Version: 0   ≤ 4.0.17
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:13:57.711860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:23:55.669Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Payment Plugins for Stripe WooCommerce",
          "vendor": "paymentplugins",
          "versions": [
            {
              "lessThanOrEqual": "4.0.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027#response\u0027 URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the \u0027Generic Errors\u0027 setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T06:40:11.010Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57c64bb5-4849-4166-9792-c079b9cbbc17?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/controllers.js#L1"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/utils.js#L1"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/dom-events.js#L1"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/gateways.js#L1"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3726506/woo-stripe-payment/trunk/assets/build/controllers.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T15:45:08.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:46:29.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Payment Plugins for Stripe WooCommerce \u003c= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via \u0027#response\u0027 URL Fragment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-89100",
    "datePublished": "2026-10-10T06:40:11.010Z",
    "dateReserved": "2026-09-10T21:36:48.568Z",
    "dateUpdated": "2026-10-11T12:23:55.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12654 (GCVE-0-2026-12654)
Vulnerability from cvelistv5
Published
2026-07-24 06:52
Modified
2026-07-24 19:55
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
Summary
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/45185f25-9a1f-411d-9d2a-295b5ceb5629?source=cve
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L60
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L60
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L54
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L24
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/wc-stripe-webhook-functions.php#L427
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/abstract/abstract-wc-stripe-payment.php#L104
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L54
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L24
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/wc-stripe-webhook-functions.php#L427
https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/abstract/abstract-wc-stripe-payment.php#L104
https://plugins.trac.wordpress.org/changeset?reponame=&old=3611878%40woo-stripe-payment&new=3611878%40woo-stripe-payment
Impacted products
Vendor Product Version
paymentplugins Payment Plugins for Stripe WooCommerce Version: 0   ≤ 4.0.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12654",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T19:55:09.941731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T19:55:36.258Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Payment Plugins for Stripe WooCommerce",
          "vendor": "paymentplugins",
          "versions": [
            {
              "lessThanOrEqual": "4.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "gidget smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin\u0027s default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T06:52:00.542Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/45185f25-9a1f-411d-9d2a-295b5ceb5629?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L60"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L60"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L54"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/controllers/class-wc-stripe-controller-webhook.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/wc-stripe-webhook-functions.php#L427"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.108/includes/abstract/abstract-wc-stripe-payment.php#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L54"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/controllers/class-wc-stripe-controller-webhook.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/wc-stripe-webhook-functions.php#L427"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/3.3.105/includes/abstract/abstract-wc-stripe-payment.php#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611878%40woo-stripe-payment\u0026new=3611878%40woo-stripe-payment"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-23T18:32:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Payment Plugins for Stripe WooCommerce \u003c= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-12654",
    "datePublished": "2026-07-24T06:52:00.542Z",
    "dateReserved": "2026-06-18T18:47:59.973Z",
    "dateUpdated": "2026-07-24T19:55:36.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}