Reflected Cross-Site Scripting Vulnerability in Payment Plugins for Stripe WooCommerce

CVE-2026-89100

What is CVE-2026-89100?

The Payment Plugins for Stripe WooCommerce plugin is vulnerable to reflected cross-site scripting (XSS) attacks via the '#response' URL fragment. This issue arises in all versions up to and including 4.0.17, primarily due to inadequate input sanitization and output escaping mechanisms. Attackers can exploit this flaw to inject arbitrary web scripts that execute in the context of a user's browser upon accessing a compromised page. Exploitation is particularly straightforward when the 'Generic Errors' setting is toggled off, allowing the function getErrorMessage() to reveal unmodified error messages directly from Stripe.

References