CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.
Explanation of Vulnerability in Simple Terms
Accept Stripe Payments contains a cross-site scripting (XSS) vulnerability in version 2.0.39. An attacker with low-level access can inject malicious scripts that execute in other users' browsers when they interact with the affected page. The vulnerability requires user interaction to trigger. Update to a patched version when available.
What an attacker can do
Inject malicious scripts that run in other users' browsers to steal data or perform actions on their behalf.
Potential impact on your site
Attackers with low-level accounts can compromise other users' sessions or steal sensitive information through script injection.
Conditions required to exploit
Low-level account access and the victim must visit or interact with a page containing the injected payload.
Key dates
External resources
Related vulnerabilities
