WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross‑site scripting flaw that allows authenticated administrators to inject malicious scripts via the AcceptStripePayments‑settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php containing script payloads in the currency_code field, causing arbitrary JavaScript execution whenever the settings page is viewed. This enables session hijacking, credential theft, or other malicious actions within the administrative context.

The vulnerability affects the WordPress plugin Accept Stripe Payments, versions 2.0.39 and earlier. Administrators who have the plugin installed and are authenticated to the WordPress admin area are at risk, because the flaw is triggered only when the options page is accessed.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is <1%, indicating a low probability of exploitation in the wild, yet the flaw remains active. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated administrators who can submit POST requests to /wp-admin/options.php. Once the payload is stored, any administrator who subsequently views the options page will have the malicious script executed in their browser. The exploit therefore requires privileged access but poses a significant risk to the integrity and confidentiality of administrative sessions.