Stripe vulnerabilities and fixes

CVEs that mention Stripe, ranked by priority. 12 tracked.

Stripe has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-10-23. Highest priority: CVE-2026-70476 (score 50/100).

• CVE-2026-70476 HIGH 8.2 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-72535 HIGH 8.6 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attacke
• CVE-2026-72536 HIGH 8.6 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attacke
• CVE-2026-59530 HIGH 7.5 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
• CVE-2026-66660 MEDIUM 6.5 Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
• CVE-2026-67329 HIGH 7.1 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an autho
• CVE-2026-61960 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
• CVE-2026-115450 HIGH 7.1 External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01
• CVE-2026-65518 MEDIUM 6.5 Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
• CVE-2026-109935 MEDIUM 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a publis
• CVE-2026-18028 LOW 2.3 The "quick setup" view presented to users after they first create an event allows to set up the most critical
• CVE-2026-98902 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq compari

FAQ

How do I fix Stripe vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Stripe being exploited right now?

None of the tracked Stripe CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Stripe CVE should I patch first?

CVE-2026-70476 currently ranks highest (50/100): Flowise is a drag & drop user interface to build a customized large language model flow.

← Back to latest CVEs