CVE-2026-6939

creationtimestamp| type| source ---|---|--- 2026-07-11 07:36:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5odud4y2e 2026-07-11 07:37:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqe5qsjszl27...

CVE-2026-6939 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approvalcode' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...