WordPress Plugin Stripe Payments 2.0.39 stores malicious JavaScript in the currency_code setting, which is executed whenever an administrator views the options page. This stored cross‑site scripting can lead to session hijacking, credential theft, or the execution of further malicious actions within the admin context.

The vulnerability exists in the WordPress plugin Accept Stripe Payments, version 2.0.39 and earlier. Administrators using this plugin are at risk, as the flaw is only triggered in the administrative interface.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Attackers must be authenticated administrators who can submit POST requests to /wp-admin/options.php. Once the payload is stored, any administrator who then views the settings will have the malicious script executed in their browser. The exploit therefore requires privileged access but poses a significant risk to the integrity and confidentiality of administrative sessions.