CVE-2026-81423: Unknown Accept Stripe Payments

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.

Affected products

• Unknown Accept Stripe Payments: before 2.1.4 (fixed in 2.1.4)

Published 2026-09-05. Last modified 2026-09-08.