PatchSiren cyber security CVE debrief

CVE-2026-8893 payaddons CVE debrief

The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions up to, and including, 1.28.0. This is due to insufficient input sanitization and output escaping on the shortcode attribute value, which is concatenated into an HTML attribute in the rendered output of the register_shortcode() function without being passed through esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor: payaddons
Product: Express Payment For Stripe
CVSS: MEDIUM 6.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-06
Original CVE updated: 2026-07-23
Advisory published: 2026-06-06
Advisory updated: 2026-07-23

Who should care

Users of the Express Payment For Stripe plugin for WordPress, particularly those with contributor-level access and above, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability exists in the Express Payment For Stripe plugin for WordPress, specifically in the handling of the 'type' attribute of the [stripe-express] shortcode. The plugin fails to properly sanitize and escape user input, allowing authenticated attackers to inject malicious scripts.

Defensive priority

MEDIUM

Recommended defensive actions

Update the Express Payment For Stripe plugin to a version that fixes this vulnerability.
Limit contributor-level access and above to trusted users only.
Regularly monitor pages for injected scripts.

Evidence notes

The CVE record (resourceLinkAnnotations: cve-org) and NVD detail (resourceLinkAnnotations: nvd) provide additional information on this vulnerability.

Sources and references

Verified primary and authoritative sources

CVE-2026-8893 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-8893

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-8893 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8893

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/wp-stripe-express/tags/1.28.0/includes/wp-stripe-shortcodes.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/wp-stripe-express/tags/1.28.0/includes/wp-stripe-shortcodes.php

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.