First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-78282

HighCVSS 7.1/10Last modified Oct 12, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
mra13	Stripe Payments	<= 2.1.2

References

https://patchstack.com/database/wordpress/plugin/stripe-payments/vulnerability/wordpress-stripe-payments-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-782837.1Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.CVE-2026-782848.6Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.CVE-2026-782858.5Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.CVE-2026-782869.8Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.CVE-2026-782889.3Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.CVE-2026-782897.1Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.CVE-2026-78297.2UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/setti CVE-2026-782906.5Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.CVE-2026-782915.3Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.CVE-2026-782929.8Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-782937.1Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.CVE-2026-782946.5Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

CVE-2026-78282: High severity, CVSS 7.1 | Vulnix