Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Stripe Payments plugin lets logged‑in users run scripts

CVE-2021-47983 · published 5 months ago
Summary

The WordPress Stripe Payments plugin (versions earlier than 2.0.40) lets anyone with a user account add malicious code into a currency setting. When an administrator opens the plugin’s settings page, the hidden code runs in their browser, potentially stealing data or changing the site. Update the plugin to version 2.0.40 or newer and verify that only trusted users have access to the admin area.

Original advisory text
WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-...
WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published8 Jun 2026
Updated30 Oct 2026
First seen8 Jun 2026
Sources
CVE-2021-47983 · NVD
Track software like this
Free during beta