CVE-2026-89100

Name of the Vulnerable Software and Affected Versions Payment Plugins for Stripe WooCommerce versions prior to 4.0.18

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) via the #response URL fragment. This occurs when the getErrorMessage() function returns a raw Stripe error string instead of a safe mapped message, which happens if the 'Generic Errors' setting is unchecked. This allows the injection of arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update to version 4.0.18 or later. Enable the 'Generic Errors' setting to prevent the getErrorMessage() function from returning raw error strings.