CVE-2025-1690 is a stored cross-site scripting vulnerability in the ThemeMakers Stripe Checkout plugin for WordPress, affecting versions up to and including 1.0.1. The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of attributes passed to the 'stripe' shortcode. Authenticated attackers with contributor-level or higher permissions can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability.

Successful exploitation allows authenticated users with contributor-level or higher permissions to inject persistent malicious scripts into pages using the 'stripe' shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure and modification of content within the affected site context. The vulnerability does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level and higher permissions to trusted users only. Consider disabling or removing the ThemeMakers Stripe Checkout plugin if it is not essential. Monitor official ThemeMakers channels for updates or patches addressing this vulnerability.