6.4 Medium

CVE-2026-0751 The Payment Page | Payment Form for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

Description

The Payment Page | Payment Form for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricing_plan_select_text_font_family' parameter in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product	Affected versions	Fixed in
Payment Page \| Payment Form for Stripe 1.4	earliest → 1.4.6	No fix stated

Do you use Payment Page | Payment Form for Stripe?

Track this CVE Watch Payment Page | Payment Form for Stripe Check my SBOMs

www.cveye.io/en/cve/CVE-2026-0751

Timeline

Published February 14, 2026
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE