Unknown Stripe Payment Forms By Wp Full Pay vulnerabilities

4 CVEs affecting Unknown Stripe Payment Forms By Wp Full Pay, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-80311, published 2026-08-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16734, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions,…
CVE-2026-77758, published 2026-08-26. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing…
CVE-2026-80311, published 2026-08-29. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling…
CVE-2026-77789, published 2026-08-26. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it,…