CVE-2026-61960

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

EUVD-2026-57968

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-61960 WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-61960 WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

PT-2026-71534

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-61960: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Full Stripe Free versions = 8.5.0...

📄 WordPress WP Full Stripe Free 8.4.3 Missing Authorization

The WP Full Stripe Free plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 8.4.3 via the wpfsupdatefailedpaymentstatus AJAX action. CVE-2026-12432: WP Full Stripe Free = 8.4.4 - Published: June 26, 2026 - Last Updated: June 27, 2026 - Researcher: Netwurm...

EUVD-2026-39957

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfsupdatefailedpaymentstatus AJAX action. The handler is registered through both wpajax and wpajaxnopriv hooks and the underlying updatefailedpaymentstatus function...

CVE-2026-12432

The CVE affects the WP Full Stripe Free plugin for WordPress, up to version 8.4.3. The vulnerability is in the wpfs_update_failed_payment_status AJAX action, where the handler is registered via wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs ...

PT-2026-53054

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs update failed payment status AJAX action. The handler is registered through both wp ajax and wp ajax nopriv hooks and the underlying update failed payment statu...

CVE-2026-12432: Missing Authorization

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfsupdatefailedpaymentstatus AJAX action. The handler is registered through both wpajax and wpajaxnopriv hooks and the underlying updatefailedpaymentstatus function...

CVE-2026-42378

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

CVE-2026-42378 WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

CVE-2026-42378

CVE-2026-42378 concerns the WordPress plugin WP Full Stripe Free (versions

CVE-2026-42378 WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

EUVD-2026-36810

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

PT-2026-49437

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

CVE-2026-42378: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by hhhai in WordPress Plugin WP Full Stripe Free versions = 8.4.1...