The Drupal Commerce Stripe module versions 2.0.0 up to but not including 2.2.3 contain a cross-site scripting (XSS) vulnerability that may be exposed under rare circumstances. Exploitation requires the attacker to have administrator permissions to configure payment gateways and also depends on the compromise of an external service. The vulnerability has been fixed in version 2.2.3.