WP Stripe Checkout
WP Stripe Checkout adds Stripe checkout forms and payment processing to WordPress websites.
WP Stripe Checkout (wp-stripe-checkout) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 25, 2026; the highest published CVSS base score is 7.5.
wp-stripe-checkoutCVE-2026-110285: WP Stripe Checkout: Missing webhook secret allows forged completed orders
WP Stripe Checkout skips Stripe webhook-signature verification when no signing secret is configured, which is its default state. In that configuration, an unauthenticated attacker can forge a payment-completion notification and create a completed order without paying. The webhook endpoint and payload field names are not disclosed in the export; the described bypass is conditional on the absent secret. Published affected versions: < 1.2.2.62.
| Safe version |
|
||
|---|---|---|---|
| Oct 25, 2026 |
CVE-2026-110285
WP Stripe Checkout: Missing webhook secret allows forged completed orders
WP Stripe Checkout skips Stripe webhook-signature verification when no signing secret is configured, which is its default state. In that configuration, an unauthenticated attacker can forge a payment-completion notification and create a completed order without paying. The webhook endpoint and payload field names are not disclosed in the export; the described bypass is conditional on the absent secret. Published affected versions: < 1.2.2.62.
|
1.2.2.62 |
CVEPending
|
| Apr 18, 2024 |
CVE-2024-32571
WP Stripe Checkout: Cross-site scripting
WP Stripe Checkout is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|
| Jan 05, 2024 |
CVE-2023-52143
WP Stripe Checkout: A security weakness
WP Stripe Checkout is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
|
| Dec 19, 2022 |
CVE-2022-3986
WP Stripe Checkout: Cross-site scripting
WP Stripe Checkout is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
|