CVE-2026-89100: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in paymentplugins Payment Plugins for Stripe WooCommerce

CVE-2026-89100 describes a reflected cross-site scripting vulnerability in the Payment Plugins for Stripe WooCommerce WordPress plugin. The issue arises from improper neutralization of input during web page generation, specifically via the '#response' URL fragment. When the 'Generic Errors' setting is unchecked, the function getErrorMessage() returns raw Stripe error strings without sanitization, enabling injection of arbitrary web scripts that execute when a user visits the crafted page. This affects all plugin versions from 0 up to and including 4.0.17.

An unauthenticated attacker can exploit this vulnerability to inject malicious scripts into pages viewed by users, potentially leading to theft of user credentials, session hijacking, or other client-side attacks. The impact is limited to confidentiality and integrity of user data in the context of the affected web pages. There is no indication of availability impact. Exploitation requires user interaction (UI:R) and the specific plugin setting to be disabled.

No official patch or fix is currently documented. Users should verify the status of the 'Generic Errors' setting and consider enabling it to prevent raw error messages from being returned. Monitor the vendor advisory for updates and patches. Until a fix is available, avoid exposing the vulnerable plugin to untrusted users or consider disabling it if feasible.