CVE-2026-89100: Stripe WooCommerce Plugin XSS Vulnerability

CVE-2026-89100 Overview

CVE-2026-89100 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Payment Plugins for Stripe WooCommerce plugin for WordPress. The flaw affects all versions up to and including 4.0.17. It stems from insufficient input sanitization and output escaping of the #response URL fragment. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim visits a crafted link. Exploitation requires the plugin's Generic Errors setting to be unchecked, which causes getErrorMessage() to return the raw Stripe error string instead of a mapped safe message. The weakness is categorized under [CWE-79].

Critical Impact

Unauthenticated reflected XSS enabling script execution in a victim's browser session on vulnerable WooCommerce checkout pages, with potential for session theft, credential harvesting, and content tampering.

Affected Products

• Payment Plugins for Stripe WooCommerce plugin for WordPress — versions ≤ 4.0.17
• WordPress sites running WooCommerce with the woo-stripe-payment plugin enabled
• Deployments where the Generic Errors plugin setting is disabled

Discovery Timeline

• 2026-10-10 - CVE-2026-89100 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-89100

Vulnerability Analysis

The vulnerability resides in client-side JavaScript handling of Stripe payment error responses. When a payment attempt fails, the plugin reads data associated with the #response URL fragment and renders it into the page as part of an error message. Because the fragment value is neither sanitized on input nor escaped on output, an attacker can craft a URL that embeds HTML or JavaScript payloads. When a user clicks the link and the checkout page processes the fragment, the payload executes in the victim's browser under the site's origin.

The scope change in the CVSS vector reflects that the injected script executes within the trusted WooCommerce page context, allowing access to cookies, session tokens, and DOM elements that are not normally reachable from a cross-origin attacker.

Root Cause

The root cause is a missing output encoding step inside the getErrorMessage() function. When the Generic Errors setting is unchecked, the function returns the raw Stripe error string verbatim rather than substituting it with a predefined, safe mapped message. The returned string is then injected into the DOM without HTML entity encoding, producing a classic reflected XSS sink.

Attack Vector

An attacker crafts a URL to the vulnerable WooCommerce checkout or payment response page with a malicious payload supplied via the #response URL fragment. The attacker distributes the link through phishing, social media, or compromised third-party sites. When a victim with an active session loads the URL, the plugin's JavaScript reads the fragment, routes it through getErrorMessage(), and renders the attacker-controlled content inside the page. The script then executes with the privileges of the victim.

No code example is reproduced here. See the Wordfence Vulnerability Report and the plugin source files listed under references for the vulnerable code paths in controllers.js, dom-events.js, gateways.js, and utils.js.

Detection Methods for CVE-2026-89100

Indicators of Compromise

• Inbound HTTP requests to WooCommerce checkout or payment response URLs containing #response= fragments with HTML tags, <script>, javascript:, or event-handler strings such as onerror= or onload=.
• Referrer logs showing external sites redirecting users to internal checkout pages with unusual fragment payloads.
• Browser console errors or unexpected outbound requests originating from checkout pages toward attacker-controlled domains.

Detection Strategies

• Inspect WordPress and WooCommerce access logs for anomalous query strings and fragment values targeting the Stripe payment endpoints.
• Deploy a Web Application Firewall (WAF) rule that flags requests to woo-stripe-payment paths containing script tags or event handlers in query parameters.
• Review the plugin configuration to confirm whether the Generic Errors setting is enabled, which neutralizes the attack path.

Monitoring Recommendations

• Centralize WordPress, WAF, and reverse proxy logs and alert on fragment-based script injection patterns targeting checkout URLs.
• Monitor the installed version of the woo-stripe-payment plugin across all WordPress sites and alert when versions ≤ 4.0.17 are detected.
• Track user-reported checkout anomalies and failed payment events that may indicate exploitation attempts.

How to Mitigate CVE-2026-89100

Immediate Actions Required

• Update the Payment Plugins for Stripe WooCommerce plugin to a version later than 4.0.17 as soon as a patched release is available.
• Enable the Generic Errors plugin setting to force getErrorMessage() to return mapped safe messages instead of raw Stripe error strings.
• Review administrator and customer accounts for signs of session hijacking or unauthorized actions following suspected exploitation.

Patch Information

The plugin maintainers published a changeset addressing the error-message handling path. Refer to the WooCommerce Stripe Controllers Change Log for the fix details and apply the latest available plugin release from the WordPress plugin repository.

Workarounds

• Toggle the Generic Errors setting to enabled in the plugin configuration until the patched version is installed.
• Deploy WAF signatures that block requests to WooCommerce payment pages carrying script-like payloads in URL fragments or query parameters.
• Apply a strict Content Security Policy (CSP) on checkout pages that disallows inline script execution and restricts script sources to trusted origins.

# Configuration example: enforce a restrictive CSP header via Apache for WooCommerce checkout pages
Header set Content-Security-Policy "default-src 'self'; script-src 'self' https://js.stripe.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"