Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
WooCommerce Stripe Payment Gateway - Security Vulnerability (CVE-2026-123145)
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be…
PLUGIN
WooCommerce Stripe Payment Gateway
CVE-2026-123145
Risk Score
Threat Entry
Updated 2026-06-17
WooCommerce Stripe Payment Gateway - Broken Access Control (CVE-2026-2381)
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to…
PLUGIN
WooCommerce Stripe Payment Gateway
CVE-2026-2381
Risk Score
Threat Entry
Updated 2026-06-17
WooCommerce Stripe Payment Gateway - Security Vulnerability (CVE-2023-34000)
Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin
PLUGIN
WooCommerce Stripe Payment Gateway
CVE-2023-34000
Risk Score