The ThemeMakers Stripe Checkout WordPress plugin is vulnerable to stored cross‑site scripting through its "stripe" shortcode. Improper input sanitization and output escaping allow an authenticated user with Contributor‑level or higher permissions to embed arbitrary script code. When a user accesses a page containing the malicious shortcode, the injected script executes in the victim’s browser, potentially leading to session hijack, credential theft, defacement, or other malicious behaviors. This flaw corresponds to CWE‑79, a classic reflected or stored XSS weakness.

All installations of the ThemeMakers Stripe Checkout plugin for WordPress with versions up to and including 1.0.1 are affected. The plugin is available on WordPress.com and self‑hosted WordPress sites, and it may appear as part of themes or theme‑marketplace bundles.

The CVSS score of 6.4 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must first obtain contributor or higher privileges on the site, then add or edit a page that uses the vulnerable shortcode. Once installed, the injected scripts will execute for all visitors to that page, making it a persistent threat for sites that have not patched or mitigated the vulnerability.