Medium severity · published Jun 8, 2026
CVE-2021-47983
WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Accept Stripe Payments · mra13
before 2.0.40 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47983
wordpress.org
https://wordpress.org/plugins/stripe-payments/#developers
www.exploit-db.com
https://www.exploit-db.com/exploits/49354
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-plugin-stripe-payments-stored-xss-via-currency-code
More from Accept Stripe Payments
5.4
CVE-2024-7353
Accept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode