CVE-2026-118560: Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Q: Who is realistically exposed to this issue?

Drupal Commerce deployments using the Commerce Stripe module in versions 2.0.0 through 2.2.3 are affected. Exploitation is described as occurring only under rare circumstances involving Stripe Connect.

Q: What does an attacker need to exploit the vulnerability?

The attacker must have administrator permissions to configure payment gateways and use Stripe Connect. Exploitation also requires compromise of an external service.

Q: Does this affect a default Commerce Stripe configuration?

The available information identifies Stripe Connect use as part of the exploitation conditions. It does not establish that installations not using Stripe Connect are affected under default configuration.

Published Oct 28, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

Other sources

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.

Under certain rare circumstances, the module may expose a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service.

— OSV

Affected Software

1 affected componentFixes available

composer/drupal/commerce_stripe>=2.0.0<2.2.3

2.2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_stripe to a version that resolves this vulnerability.
Fixed in 2.2.3

Event History

Oct 28, 2026

Advisory Published

via OSV·04:57 PM

Data Sourced

via OSV·04:57 PM

DescriptionAffected Software

Oct 30, 2026

CVE Published

via MITRE·03:09 AM

Data Sourced

via MITRE·03:09 AM

DescriptionWeakness

Data Sourced

via NVD·04:18 AM

DescriptionWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Drupal Commerce deployments using the Commerce Stripe module in versions 2.0.0 through 2.2.3 are affected. Exploitation is described as occurring only under rare circumstances involving Stripe Connect.

What does an attacker need to exploit the vulnerability?

The attacker must have administrator permissions to configure payment gateways and use Stripe Connect. Exploitation also requires compromise of an external service.

Does this affect a default Commerce Stripe configuration?

The available information identifies Stripe Connect use as part of the exploitation conditions. It does not establish that installations not using Stripe Connect are affected under default configuration.

CVE-2026-118560: Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Does this affect a default Commerce Stripe configuration?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Does this affect a default Commerce Stripe configuration?