{"id":"CVE-2026-81423","title":"The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leverage…","summary":"The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leverage…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-601"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81423","references":[{"url":"https://wpscan.com/vulnerability/0e4bbbde-b93e-4b58-8baf-301073e9a0c5/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00297,"epssPercentile":0.19882,"ingestedAt":"2026-09-06T04:50:00.853Z","slug":"CVE-2026-81423","body":"## Overview\n\nThe Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8247,"id":"CVE-2026-81423","ts":1788919994037,"field":"cvss","old":null,"new":"4.3"},{"seq":8246,"id":"CVE-2026-81423","ts":1788919994037,"field":"severity","old":"none","new":"medium"},{"seq":8056,"id":"CVE-2026-81423","ts":1788919280828,"field":"cvss","old":"4.3","new":null},{"seq":8055,"id":"CVE-2026-81423","ts":1788919280828,"field":"severity","old":"medium","new":"none"},{"seq":7865,"id":"CVE-2026-81423","ts":1788916354691,"field":"cvss","old":null,"new":"4.3"},{"seq":7864,"id":"CVE-2026-81423","ts":1788916354691,"field":"severity","old":"none","new":"medium"},{"seq":7674,"id":"CVE-2026-81423","ts":1788915297530,"field":"cvss","old":"4.3","new":null},{"seq":7673,"id":"CVE-2026-81423","ts":1788915297530,"field":"severity","old":"medium","new":"none"},{"seq":7483,"id":"CVE-2026-81423","ts":1788912714107,"field":"cvss","old":null,"new":"4.3"},{"seq":7482,"id":"CVE-2026-81423","ts":1788912714107,"field":"severity","old":"none","new":"medium"},{"seq":7292,"id":"CVE-2026-81423","ts":1788911331457,"field":"cvss","old":"4.3","new":null},{"seq":7291,"id":"CVE-2026-81423","ts":1788911331457,"field":"severity","old":"medium","new":"none"},{"seq":7096,"id":"CVE-2026-81423","ts":1788909077345,"field":"cvss","old":null,"new":"4.3"},{"seq":7095,"id":"CVE-2026-81423","ts":1788909077345,"field":"severity","old":"none","new":"medium"},{"seq":6908,"id":"CVE-2026-81423","ts":1788907391563,"field":"cvss","old":"4.3","new":null},{"seq":6907,"id":"CVE-2026-81423","ts":1788907391563,"field":"severity","old":"medium","new":"none"},{"seq":6710,"id":"CVE-2026-81423","ts":1788905443665,"field":"cvss","old":null,"new":"4.3"},{"seq":6709,"id":"CVE-2026-81423","ts":1788905443665,"field":"severity","old":"none","new":"medium"},{"seq":6528,"id":"CVE-2026-81423","ts":1788903459786,"field":"cvss","old":"4.3","new":null},{"seq":6527,"id":"CVE-2026-81423","ts":1788903459786,"field":"severity","old":"medium","new":"none"},{"seq":6315,"id":"CVE-2026-81423","ts":1788901810454,"field":"cvss","old":null,"new":"4.3"},{"seq":6314,"id":"CVE-2026-81423","ts":1788901810454,"field":"severity","old":"none","new":"medium"},{"seq":6145,"id":"CVE-2026-81423","ts":1788899562209,"field":"cvss","old":"4.3","new":null},{"seq":6144,"id":"CVE-2026-81423","ts":1788899562209,"field":"severity","old":"medium","new":"none"},{"seq":6029,"id":"CVE-2026-81423","ts":1788898240485,"field":"cvss","old":null,"new":"4.3"},{"seq":6028,"id":"CVE-2026-81423","ts":1788898240485,"field":"severity","old":"none","new":"medium"}]}