Wp Full Stripe Free Vulnerabilities

The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...

CVSS:

7.2

Affected:

up to 8.5.0

Fixed in:

8.5.1

Disclosed:

Aug 6, 2026

CVE-2026-61960 on NVD →

The Stripe Payment Forms by WP Full Pay plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 8.5.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 8.5.1

Fixed in:

8.5.2

Disclosed:

Jul 30, 2026

CVE-2026-16734 on NVD →

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs...

CVSS:

5.3

Affected:

up to 8.4.3

Fixed in:

8.5.0

Disclosed:

Jun 26, 2026

CVE-2026-12432 on NVD →

The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 8.4.1. This makes it possible for authenticated attackers, with Subscriber-leve...

CVSS:

4.3

Affected:

up to 8.4.1

Fixed in:

8.4.2

Disclosed:

Jun 1, 2026

CVE-2026-42378 on NVD →

The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVSS:

7.5

Affected:

up to 8.3.1

Fixed in:

8.3.2

Disclosed:

Oct 24, 2025

CVE-2025-9322 on NVD →

The WP Full Stripe Free plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 8.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level acce...

CVSS:

4.9

Affected:

up to 8.2.5

Fixed in:

8.2.6

Disclosed:

Sep 5, 2025

CVE-2025-58789 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free allows SQL Injection. This issue affects WP Full Stripe Free: from n/a through 8.3.0.

Affected:

up to 8.3.0

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58789 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Mammothology WP Full Stripe Free.This issue affects WP Full Stripe Free: from n/a through 7.0.16.

Affected:

up to 7.0.18

Fixed in:

7.0.18

Disclosed:

Nov 18, 2023

CVE-2023-47667 on NVD →

The WP Full Stripe Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.0.17. This is due to missing or incorrect nonce validation via several functions in the ~/include/wp-full-stripe-admin-menu.php file. This makes it possible for unauthenticated attackers to modif...

CVSS:

4.3

Affected:

up to 7.0.17

Fixed in:

7.0.18

Disclosed:

Nov 8, 2023

CVE-2023-47667 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.

Affected:

up to 7.0.6

Fixed in:

7.0.6

Disclosed:

Oct 26, 2023

CVE-2023-46088 on NVD →

The WP Full Stripe Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inje...

CVSS:

4.4

Affected:

up to 7.0.5

Fixed in:

7.0.6

Disclosed:

Oct 17, 2023

CVE-2023-46088 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.

Affected:

up to 7.0.6

Fixed in:

7.0.6

Disclosed:

Aug 8, 2023

CVE-2023-28934 on NVD →

The WP Full Stripe Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in...

CVSS:

4.4

Affected:

up to 7.0.5

Fixed in:

7.0.6

Disclosed:

Jul 5, 2023

CVE-2023-28934 on NVD →

Affected:

up to 8.3.2

Fixed in:

8.3.2

CVE-2025-9322 on NVD →