VulnSocial

CVE-2026-8893Disclosure

LOWCVSS 6.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions up to, and including, 1.28.0. This is due to insufficient input sanitization and output escaping on the shortcode attribute value, which is concatenated into an HTML attribute in the rendered output of the register_shortcode() function without being passed through esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-07); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-07: 2Mentions · 2026-06-13: 1PoC Mentioned / Linked · 2026-06-13: 1Exploit Tool / Code · 2026-06-13: 1Technical Details · 2026-06-07: 206-0706-13
Signal classification2 categories
Disclosure
266.7%
PoC
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-072
Disclosure2
2026-06-131
PoC1
Full discourse3 posts
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-8893-wp-stripe-express-version-1-28-0-medium-vulnerability-proof-of-concept CVE-2026-8893 wp-stripe-express (CVSS Score 6.4) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #ato…

    Post summary

    Proof‑of‑concept code for CVE‑2026‑8893, a medium‑severity vulnerability in the WordPress Stripe Express plugin, is publicly available via the provided link.

    0000028
    9 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-8893 The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions … https://www.cve.org/CVERecord?id=CVE-2026-8893 ----- Traducción: CVE-2026-8893 El … http://infoflow.cloud`

    Post summary

    The post announces CVE-2026‑8893, describing a stored XSS flaw in the Express Payment For Stripe plugin for WordPress, but it offers no PoC, exploit code, patch info, or evidence of active attacks.

    0000027
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-8893 The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions … https://www.cve.org/CVERecord?id=CVE-2026-8893

    Post summary

    The post announces a stored XSS vulnerability in the Express Payment for Stripe plugin for WordPress, detailing the vulnerable 'type' shortcode attribute, but provides no PoC, exploit, or patch information.

    00000242
    57.6K followersView on X

Explore more

Back to dashboard