CVE-2026-61960

The CVSS 7.1/EPSS 0.0018 gap on this unauthenticated XSS in WP Full Stripe Free is a measurement artifact, not a security assurance. EPSS models bot-driven exploitation, and bots target WordPress core and the 30 most popular plugins—this niche Stripe integration doesn't register. The 0.18% 30-day exploitation probability tells you automated scanners are ignoring it; it tells you nothing about whether a targeted operator has already found it. The payment-context is what matters. This plugin handles Stripe API keys, webhook secrets, and transaction data. The XSS entry point—whether in admin error displays, customer metadata rendering, or webhook logging—doesn't need to be in the checkout flow to be dangerous. Compromising an admin session gives attackers configuration access: Stripe API credentials, webhook URLs, subscription handling settings. That's lateral movement into a financial processing relationship, not just session hijacking. Here's what to check and do: First, identify whether this plugin is installed and verify the version. If you're running any version before the patch, treat it as an immediate priority—not because bots will find it, but because targeted operators targeting e-commerce sites specifically look for payment plugins. Second, audit what the plugin can access in your admin panel: API keys, webhook configuration, customer data exports. If those are exposed, the XSS becomes a credential theft vector. Third, examine your change-detection tooling—EPSS won't catch unsanitized output in a niche plugin, so your own scanning or code review processes need to catch what automated threat intelligence misses. Fourth, check whether your PCI-DSS scope includes this plugin. Even if it's not formally in the cardholder data environment, it touches payment metadata that may expand your compliance obligations. The abandoned-installation problem deserves attention too. If this plugin is running on sites where the maintainer has moved on, the vulnerability persists indefinitely regardless of what future versions ship. Low EPSS scores become organizational permission structures to deprioritize—precisely the condition that leaves forgotten payment plugins as permanent artifacts in WordPress installations, still exposing financial credentials years after the last update.

Reviewed through automated stages and approved by a human before publication.