CVE-2026-14236

CVE-2026-14236 affects the Contact Form 7 – PayPal & Stripe Add-on for WordPress, specifically versions before 2.5. The vulnerability arises because the plugin does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout....