Stored Cross-Site Scripting Vulnerability in ThemeMakers Stripe Checkout for WordPress

CVE-2025-1690

What is CVE-2025-1690?

The ThemeMakers Stripe Checkout plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping for attributes supplied by users, specifically in the 'stripe' shortcode. Authenticated attackers with contributor-level permissions can exploit this vulnerability to inject malicious web scripts into pages. When these pages are accessed by users, the scripts will execute, compromising site integrity and potentially leading to data theft or further attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References