CVE-2021-47983: Stripe Payments Plugin XSS Vulnerability

CVE-2021-47983 Overview

CVE-2021-47983 is a stored cross-site scripting (XSS) vulnerability in the WordPress Stripe Payments plugin version 2.0.39. The flaw resides in the AcceptStripePayments-settings[currency_code] parameter exposed through /wp-admin/options.php. An authenticated attacker with access to the plugin settings can submit a POST request containing JavaScript payloads in the currency_code field. The injected script is stored and later executed in the browser of any administrator who views the settings page. The issue is tracked under [CWE-79] and has a CVSS v4.0 base score of 5.1.

Critical Impact
Authenticated attackers can persist arbitrary JavaScript that runs in administrator sessions, enabling account takeover paths, settings tampering, and downstream WordPress compromise.

Affected Products

WordPress Plugin Stripe Payments 2.0.39
WordPress installations using the stripe-payments plugin at the affected version
Administrator interfaces rendering plugin settings stored via wp-admin/options.php

Discovery Timeline

2026-06-08 - CVE-2021-47983 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2021-47983

Vulnerability Analysis

The Stripe Payments plugin stores its configuration through the standard WordPress options API. Settings submitted to /wp-admin/options.php are persisted without sufficient sanitization or output encoding for the currency_code field. When an administrator opens the plugin's settings page, the stored value is rendered into HTML context, causing any embedded <script> payload to execute in the administrator's authenticated session.

Because the payload is persisted server-side, exploitation does not require social engineering each victim. Any privileged user who later views the settings page becomes a target. The attacker prerequisite is an authenticated WordPress account with permissions to update plugin settings, which limits but does not eliminate risk in multi-author or compromised low-privilege accounts.

Root Cause

The root cause is missing input validation and missing output escaping for the AcceptStripePayments-settings[currency_code] option. The plugin treats the value as a trusted string rather than constraining it to an ISO 4217 currency code or applying esc_html() or esc_attr() at render time. This violates standard WordPress secure coding guidance for option storage and display.

Attack Vector

The attacker sends a POST request to /wp-admin/options.php with a script payload assigned to the AcceptStripePayments-settings[currency_code] parameter. The server accepts and stores the value. When an administrator subsequently visits the plugin settings page, the payload executes in the administrator's browser under the WordPress origin. Resulting actions can include session token exfiltration, creation of new administrative users via the WordPress REST API, or modification of payment settings to redirect transactions. Technical proof-of-concept details are documented in Exploit-DB #49354 and the VulnCheck Advisory on XSS.

Detection Methods for CVE-2021-47983

Indicators of Compromise

POST requests to /wp-admin/options.php where the AcceptStripePayments-settings[currency_code] parameter contains HTML or script tags such as <script>, onerror=, or javascript:.
WordPress wp_options rows for AcceptStripePayments-settings containing values that do not match a three-letter currency code pattern.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the Stripe Payments settings page.
New WordPress administrator accounts or modified user roles created without a corresponding admin-initiated session.

Detection Strategies

Inspect HTTP request bodies destined for /wp-admin/options.php for non-alphanumeric characters in the currency_code field, especially angle brackets and event handler keywords.
Query the WordPress database for AcceptStripePayments-settings option values containing <, >, or script substrings.
Correlate authenticated admin page views of plugin settings with subsequent anomalous browser-originated API calls to /wp-json/wp/v2/users or /wp-admin/user-new.php.

Monitoring Recommendations

Enable WordPress audit logging for option changes and administrator role modifications.
Forward web server access logs and WAF events to a centralized analytics platform for retrospective hunting on the currency_code parameter.
Alert on POST requests to wp-admin/options.php originating from low-privilege accounts that have recently been granted settings access.

How to Mitigate CVE-2021-47983

Immediate Actions Required

Update the Stripe Payments plugin to a version later than 2.0.39 that addresses the currency_code sanitization gap.
Audit the AcceptStripePayments-settings option in wp_options and reset the currency_code field to a valid ISO 4217 value.
Review WordPress administrator accounts created or modified since the plugin was installed and rotate credentials and session tokens.
Restrict the WordPress manage_options capability to a minimal set of trusted administrators.

Patch Information

Upgrade to the latest release published on the WordPress Plugin Documentation page. Confirm the installed version is greater than 2.0.39 after the update and clear any cached settings pages.

Workarounds

Deploy a web application firewall rule blocking POST requests to /wp-admin/options.php where AcceptStripePayments-settings[currency_code] contains characters outside [A-Za-z]{3}.
Apply a Content Security Policy (CSP) header on /wp-admin/ responses that disallows inline script execution to limit stored XSS impact.
Temporarily disable the Stripe Payments plugin if a patched version cannot be installed and payment processing can be paused.

bash

# Example WAF rule (ModSecurity) blocking script payloads in currency_code
SecRule ARGS:"AcceptStripePayments-settings[currency_code]" "!@rx ^[A-Za-z]{3}$" \
  "id:1004783,phase:2,deny,status:403,log,\
   msg:'CVE-2021-47983 Stripe Payments currency_code XSS attempt'"