CVE-2026-118560

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting XSS. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...

CVE-2026-118558

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...

CVE-2026-118559

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3...

EUVD-2026-113509

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...

CVE-2026-118558

The Commerce Stripe module for Drupal is vulnerable to a Cross-Site Request Forgery (CSRF) (CVE-2026-118558) affecting versions 2.0.0 to 2.2.3 . The root cause is the module's failure to include a CSRF token in the return URI when redirecting to Stripe Connect to generate an authorization code. A...

EUVD-2026-113508

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3...

CVE-2026-118559

The Drupal Commerce Stripe module is vulnerable to a Signature Spoof attack due to improper verification of cryptographic signatures. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook events. This vul...

EUVD-2026-113507

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting XSS. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...

CVE-2026-118560

The Drupal Commerce Stripe module (versions 2.0.0 to 2.2.3 ) is vulnerable to a Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. This vulnerability allows an attacker to execute malicious scripts in a user's browser. Remediation details are p...

DRUPAL-CONTRIB-2026-265

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. Under certain rare circumstances, the module may expose a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attack...

EUVD-2025-119994

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...

CVE-2025-12633 Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...

CVE-2025-12633: Missing Authorization

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...