Description

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:02.420Z",
  "pubdate": "2026-08-13T14:17:02.420Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the WP Full Stripe Free plugin, affecting all versions up to and including 8.5.0. This security flaw enables remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the affected software.\nThe primary impact of this vulnerability involves the potential compromise of administrative or user sessions, arbitrary JavaScript execution within the context of a victim's browser, and subsequent actions performed on behalf of the authenticated user, such as credential theft or unauthorized plugin configuration changes.\nThe affected product is WP Full Stripe Free versions <= 8.5.0. The risk implications are severe for deployments utilizing vulnerable versions, as exploitation requires no prior authentication or specialized privileges, lowering the barrier to entry for malicious actors.\nExploitation requirements are minimal, relying solely on network exposure to the target WordPress instance where the vulnerable component accepts and improperly sanitizes or escapes user-supplied input before reflecting it back to the client browser.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated Cross-Site Scripting (XSS) flaw residing within the WP Full Stripe Free plugin for WordPress, specifically impacting versions 8.5.0 and prior. The root cause stems from inadequate input sanitization and output encoding of parameters processed by the plugin before they are rendered in the Document Object Model (DOM) of the victim's browser.\nThe vulnerable component handles HTTP requests containing user-controlled parameters without properly validating or escaping the input. Because the vulnerability is unauthenticated, an attacker does not require any pre-existing account credentials, privileges, or session tokens on the target WordPress installation to interact with the vulnerable endpoint.\nThe network exposure is public-facing, meaning any HTTP or HTTPS request originating from the internet can reach the vulnerable parameter, provided the endpoint is accessible. The attack flow initiates when an attacker crafts a malicious URI or HTTP request containing payload data consisting of HTML-encoded or raw JavaScript strings.\nWhen a victim visits a crafted URL or interacts with the malicious link generated by the attacker, the server processes the request and embeds the unsanitized input directly into the HTTP response. Upon parsing the response, the victim's browser executes the injected payload within the security context of the origin site.\nThe payload behavior includes executing arbitrary script code in the context of the user's session. Depending on the privileges of the victim viewing the affected page, post-exploitation impact can range from session hijacking via cookie theft, manipulation of DOM elements, redirection to malicious external domains, to performing administrative actions if an authenticated administrator falls victim to the exploit vector."
}