CVE-2026-0751 is a stored cross-site scripting vulnerability in the Payment Page | Payment Form for Stripe WordPress plugin by brandonfire. The issue exists in all versions up to and including 1.4.6 due to improper neutralization of input in the 'pricing_plan_select_text_font_family' parameter. Authenticated attackers with Author-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users visiting the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits in the wild have been reported. No patch or official fix information is currently provided.

Successful exploitation allows authenticated users with Author-level access or above to inject persistent malicious scripts into plugin pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of other users. There is no impact on availability. The vulnerability requires authentication and privileges, reducing the overall risk compared to unauthenticated XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to the 'pricing_plan_select_text_font_family' parameter. Monitor plugin updates from brandonfire for a security patch addressing this vulnerability.