The Express Payment For Stripe plugin allows an authenticated contributor or higher to store malicious scripts through the 'type' attribute of the [stripe-express] shortcode. Input sanitization is omitted, and the value is inserted directly into an HTML attribute, resulting in a stored XSS flaw classified as CWE‑79. An attacker can cause any visitor to the compromised page to execute arbitrary JavaScript, potentially leading to session hijacking, defacement, or theft of sensitive data.

WordPress sites running the Express Payment For Stripe plugin from payaddons. Versions up to and including 1.28.0 are vulnerable. Any installation of 1.28.0 or earlier that contains the shortcode with an unescaped 'type' attribute is impacted.

The CVSS score of 6.4 indicates moderate severity. Because the flaw exposes stored XSS only to authenticated users with contributor permissions, the attack requires legitimate credentials but can affect all visitors who view the page. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. The exploit path is straightforward: an authenticated contributor modifies a shortcode value, and the malicious script is stored in the database and runs for all subsequent page views.