Stored Cross-Site Scripting Vulnerability in ThemeMakers Stripe Checkout for WordPress

CVE-2025-1690

What is CVE-2025-1690?

The ThemeMakers Stripe Checkout plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping for attributes supplied by users, specifically in the 'stripe' shortcode. Authenticated attackers with contributor-level permissions can exploit this vulnerability to inject malicious web scripts into pages. When these pages are accessed by users, the scripts will execute, compromising site integrity and potentially leading to data theft or further attacks.

References