CVE-2026-8893 describes a stored Cross-Site Scripting vulnerability in the Express Payment For Stripe plugin for WordPress. The issue exists because the 'type' attribute of the [stripe-express] shortcode is not properly sanitized or escaped before being inserted into an HTML attribute in the output generated by the register_shortcode() function. This flaw enables authenticated attackers with contributor-level privileges or above to inject arbitrary JavaScript code into pages, which executes in the context of users viewing those pages. The vulnerability affects all versions from initial release up to 1.28.0 inclusive.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages using the vulnerable shortcode. This can lead to theft of user credentials, session hijacking, or other malicious actions executed in the context of users visiting the compromised pages. The vulnerability does not affect availability but impacts confidentiality and integrity of user data.

No official patch or fix has been confirmed at this time. Users should upgrade to a version later than 1.28.0 once available. Until then, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode if possible. Monitor the vendor's advisory channels for updates regarding an official fix.