Stored Cross-Site Scripting Vulnerability in Buy Now Plus Plugin for WordPress
CVE-2026-1295

6.4MEDIUM

Key Information:

Vendor: WordPress
Status: Stripe Payments By Buy Now Plus – Best WordPress Stripe Credit Card Payments Plugin
Vendor: CVE Published:; 28 January 2026

What is CVE-2026-1295?

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is susceptible to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping in the 'buynowplus' shortcode. This vulnerability enables authenticated users with Contributor-level access or higher to inject malicious scripts, which can execute on pages accessed by other users, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Stripe Payments by Buy Now Plus – Best WordPress Stripe Credit Card Payments Plugin * <= 1.0.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/buy-now-plus/t...

CVSS V3.1

Score:

6.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Jan 28, 2026
Vulnerability Reserved
Jan 21, 2026

Credit

Youcef Hamdani

JSON

WordPress