CVE-2026-89100

MediumCVSS 6.1/10Last modified Oct 13, 2026

Description

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 'Generic Errors' setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-891026.5In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can l CVE-2026-891054.2The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSU CVE-2026-891064.4SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially cr CVE-2026-891079.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that util CVE-2026-891089.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative function CVE-2026-89116.1The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to CVE-2026-891109.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privile CVE-2026-8911110.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the ten CVE-2026-891126.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the targe CVE-2026-891138.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authentica CVE-2026-891165.9The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to CVE-2026-891176.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect