Stored Cross-Site Scripting Vulnerability in Accept Stripe Payments Plugin for WordPress

CVE-2024-7353

What is CVE-2024-7353?

The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the 'accept_stripe_payment_ng' shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in all versions up to 2.0.86. Authenticated attackers with contributor-level access or higher can exploit this weakness to inject malicious web scripts, leading to execution whenever a user accesses the compromised page. This poses a significant risk to site integrity and user safety.

References