Known vulnerabilities in Payment Plugins for Stripe WooCommerce

Accept Credit Cards, Google Pay, ApplePay, Afterpay, Affirm, ACH, Klarna, iDEAL and more all in one plugin for free!

5Reported vulnerabilities

6.1Highest CVSS score

4.0.10Latest version

100,000+Active installs

What to do now

Update Payment Plugins for Stripe WooCommerce to 4.0.18 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-89100	Medium 6.1	0.2%	0 to 4.0.17 (inclusive)	`4.0.18`	October 10, 2026
CVE-2026-12654	Medium 5.3	0.6%	0 to 4.0.7 (inclusive)	`4.0.8`	July 24, 2026
CVE-2026-80339	Medium 5.3	0.3%	4.0.11 and earlier	`4.0.12`	September 7, 2026
CVE-2026-59530	Medium 5.3	0.3%	4.0.7 and earlier	`4.0.8`	July 23, 2026
CVE-2021-39347	Medium 4.3	0.7%	3.0.0 to 3.3.9 (inclusive)	`3.3.10`	October 4, 2021

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.