The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leverage…

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.2%

3. Sep 7, 2026EPSS peak

   0.2% → 0.2%

4. Sep 8, 2026Record revised

   Last analysed / modified upstream

5. Sep 8, 2026CVSS changed

   4.3 → —

6. Sep 8, 2026Severity changed

   medium → none

7. Sep 9, 2026CVSS changed

   — → 4.3

8. Sep 9, 2026Severity changed

   none → medium

9. Sep 9, 2026CVSS changed

   4.3 → —

10. Sep 9, 2026Severity changed

    medium → none

11. Sep 9, 2026CVSS changed

    — → 4.3

12. Sep 9, 2026Severity changed

    none → medium

13. Sep 9, 2026CVSS changed

    4.3 → —

14. Sep 9, 2026Severity changed

    medium → none

15. Sep 9, 2026CVSS changed

    — → 4.3

16. Sep 9, 2026Severity changed

    none → medium

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 4.3
• Sep 9, 2026Severity none → medium
• Sep 9, 2026CVSS 4.3 → —
• Sep 9, 2026Severity medium → none
• Sep 9, 2026CVSS — → 4.3
• Sep 9, 2026Severity none → medium
• Sep 9, 2026CVSS 4.3 → —
• Sep 9, 2026Severity medium → none
• Sep 9, 2026CVSS — → 4.3
• Sep 9, 2026Severity none → medium
• Sep 8, 2026CVSS 4.3 → —
• Sep 8, 2026Severity medium → none