Reflected Cross-Site Scripting in Accept Stripe Payments Plugin for WordPress
CVE-2025-12834

6.1MEDIUM

Key Information:

Vendor: WordPress
Status: Accept Stripe Payments Using Contact Form 7
Vendor: CVE Published:; 12 December 2025

What is CVE-2025-12834?

The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is susceptible to a Reflected Cross-Site Scripting vulnerability through the 'failure_message' parameter. This issue arises from inadequate input sanitization and output escaping in versions up to and including 3.1. An attacker could exploit this vulnerability by tricking users into clicking on a crafted link, allowing them to execute arbitrary web scripts within the context of a user's browser session.

Affected Version(s)

Accept Stripe Payments Using Contact Form 7 * <= 3.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/accept-stripe-...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Dec 12, 2025
Vulnerability Reserved
Nov 6, 2025

Credit

Md. Moniruzzaman Prodhan

JSON