Cross-Site Scripting Issue in Simple Stripe Checkout by Growniche

CVE-2025-49963

What is CVE-2025-49963?

The Simple Stripe Checkout plugin by Growniche has a security flaw that allows attackers to execute arbitrary scripts in the context of the user’s session, known as Cross-Site Scripting (XSS). This vulnerability notably affects versions up to and inclusive of 1.1.28. When exploited, an attacker could craft malicious input that a victim would inadvertently execute, potentially compromising sensitive data and user interactions. Proper input validation and sanitization measures are essential to mitigate this risk.

References