CVE-2026-118558

The Commerce Stripe module for Drupal is vulnerable to a Cross-Site Request Forgery (CSRF) (CVE-2026-118558) affecting versions 2.0.0 to 2.2.3 . The root cause is the module's failure to include a CSRF token in the return URI when redirecting to Stripe Connect to generate an authorization code. A...

EUVD-2026-113509

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...

CVE-2026-118559

The Drupal Commerce Stripe module is vulnerable to a Signature Spoof attack due to improper verification of cryptographic signatures. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook events. This vul...

EUVD-2026-113508

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3...

CVE-2026-118560

The Drupal Commerce Stripe module (versions 2.0.0 to 2.2.3 ) is vulnerable to a Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. This vulnerability allows an attacker to execute malicious scripts in a user's browser. Remediation details are p...

EUVD-2026-113507

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting XSS. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...