CVE-2021-47983: Stored XSS in Stripe Payments WordPress Plugin 2.0.39

Technical summary

CVE-2021-47983 is a stored XSS vulnerability in Stripe Payments 2.0.39 resulting from improper input validation on the AcceptStripePayments-settings[currency_code] parameter. The vulnerability exists in the /wp-admin/options.php endpoint, where POST requests containing script payloads in the currency_code field are stored without adequate sanitization. Subsequently, when administrators load the plugin settings page, the stored payload executes in the context of the WordPress admin panel, bypassing Content Security Policy protections through the cross-site flag (S:C in the CVSS vector).

Business impact

While exploitation requires authenticated access, a compromised lower-privileged WordPress account (e.g., shop manager, editor) can inject malicious scripts that execute with administrator-level visibility. This enables attackers to harvest sensitive data, create rogue administrator accounts, modify payment configurations, or redirect transactions. For e-commerce sites processing payments via Stripe, this creates both compliance risk and direct revenue exposure.

Affected systems

Stripe Payments WordPress plugin version 2.0.39 is explicitly affected. Organizations running this plugin should verify their installed version immediately. Newer versions may address this issue; consult the plugin's changelog or security advisories for remediation guidance.

Exploitability

Exploitation requires an authenticated WordPress user account, making this a post-authentication attack. The CVSS score of 6.4 reflects the medium severity: while the barrier to initial access is low (compromised credentials are common), the impact is elevated due to the administrative context of execution. No user interaction is required once a request is crafted, and the attack leaves persistent artifacts in the database that affect multiple administrators.

Remediation

Immediately update Stripe Payments to a patched version. Verify against the official WordPress plugin repository or vendor security advisory for the minimum safe version. If immediate patching is not possible, restrict administrator and shop-manager-level account access to trusted personnel and monitor wp_options table modifications for suspicious currency_code entries.

Patch guidance

Check the Stripe Payments plugin page on WordPress.org for the latest available version. Review the changelog for security fixes related to input validation. Test patches in a staging environment before production deployment, as payment plugins are security-critical. If your hosting provider manages updates automatically, verify that this plugin receives timely patches.

Detection guidance

Audit wp_options table entries, specifically the AcceptStripePayments-settings option, for suspicious script tags or encoded payloads. Check WordPress admin audit logs for settings modifications by lower-privileged accounts. Monitor for unusual JavaScript execution in admin panel request/response cycles using browser developer tools or WAF logs. Implement database integrity monitoring to alert on changes to options containing serialized plugin configuration.

Why prioritize this

Although this vulnerability requires authenticated access, the confluence of factors—persistent storage, administrative execution context, payment system exposure, and ease of crafting malicious settings—warrants prompt patching. Organizations with shared WordPress environments or contractor access should prioritize this higher. The stored nature of the XSS means a single injection compromises all administrators indefinitely until the malicious option is removed.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects authentication as a prerequisite (PR:L), but the cross-site impact scope (S:C) and confidentiality/integrity consequences (C:L/I:L) elevate the risk. The lack of availability impact (A:N) prevents a higher score. In practice, organizations should treat this as high-priority because it affects payment processing infrastructure and can lead to lateral privilege escalation or data theft.

Frequently asked questions