2717 matches found
PT-2025-30113 · WordPress · Avishi Wp Paypal Payment Button
Name of the Vulnerable Software and Affected Versions: Avishi WP PayPal Payment Button versions prior to 2.1 Description: The Avishi WP PayPal Payment Button plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...
CVE-2025-6814
The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportnow function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal...
CVE-2025-6814 Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function
The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportnow function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal...
Malicious code in walletsendmoney-paypal (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77ab40d8bb0c8f25b6a75b9fb6c84c5faaef81ebd1a833649ca79fad2841deb9 Any computer that has this package installed or running should be considered...
MAL-2025-5295 Malicious code in walletsendmoney-paypal (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77ab40d8bb0c8f25b6a75b9fb6c84c5faaef81ebd1a833649ca79fad2841deb9 Any computer that has this package installed or running should be considered...
Malicious code in retaillocationserv-paypal (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0409d54039e50835f5e9986281184dc84f53f8c20c6a838505fcd8097c538feb The OpenSSF Package Analysis project identified...
CVE-2025-48111
Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0...
GHSA-8G98-M4J9-QWW5 Taylored webhook validation vulnerabilities
Critical Security Advisory for Taylored npm package v7.0.7 - tag 7.0.5 Summary A series of moderate to high-severity security vulnerabilities have been identified specifically in version 7.0.7 of \taylored. These vulnerabilities reside in the "Backend-in-a-Box" template distributed with this...
CVE-2025-48111
Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0...
CVE-2025-48111 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0...
CVE-2025-48111 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0...
CVE-2025-48111
CVE-2025-48111 (WordPress/YITH PayPal Express Checkout for WooCommerce) is a CSRF vulnerability in the YITH PayPal Express Checkout plugin for WooCommerce, affecting versions up to 1.49.0. The issue permits cross-site request forgery actions, with CVSS 3.1 base score 4.3 (Attack Vector: Network, ...
WordPress plugin YITH PayPal Express Checkout for WooCommerce 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
PT-2025-25683 · Yith · Yith Paypal Express Checkout For Woocommerce
Name of the Vulnerable Software and Affected Versions: YITH PayPal Express Checkout for WooCommerce versions 1.49.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. Recommendations: For YITH PayPal Express Checkout for WooCommer...
WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin YITH PayPal Express Checkout for WooCommerce versions = 1.49.0...
Malicious code in mediaserv-paypal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15084239e2cd202b683ccc27fbc1eca45909c74e4e992b9d5e646ccb07c3cfd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4851 Malicious code in mediaserv-paypal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15084239e2cd202b683ccc27fbc1eca45909c74e4e992b9d5e646ccb07c3cfd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-5117 Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration
The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the propertypackageuserrole metadata in versions 1.0.5 to 1.0.6. This makes it possible for authenticated attackers, with Author‐level access and above, to elevate their...
CVE-2025-22525
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bharat Kambariya Donation Block For PayPal donations-block allows Stored XSS.This issue affects Donation Block For PayPal: from n/a through = 2.2.0...