CVE-2026-89100Published
Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-89100 · Microsoft / collected KEV context
cve-program · CVE-2026-89100
- https://www.wordfence.com/threat-intel/vulnerabilities/id/57c64bb5-4849-4166-9792-c079b9cbbc17?source=cve
- https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/controllers.js#L1
- https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/utils.js#L1
- https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/dom-events.js#L1
- https://plugins.trac.wordpress.org/browser/woo-stripe-payment/tags/4.0.14/assets/build/gateways.js#L1
- https://plugins.trac.wordpress.org/changeset/3726506/woo-stripe-payment/trunk/assets/build/controllers.js
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.