CVE-2026-12501

CVE-2026-12501 affects the WP Travel Engine plugin for WordPress, prior to version 6.8.2. The vulnerability arises because the plugin does not verify that an incoming PayPal IPN is sent to the site’s merchant account, nor that the paid amount matches the order total, before marking a booking as p...

CVE-2026-15152

The vulnerability affects WP Hotel Booking plugin for WordPress prior to 2.3.2. It allows unauthenticated users to mark bookings as fully paid without actual payment: the plugin fails to verify that a PayPal payment notification corresponds to a payment to the site’s merchant account and that the...

CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

CVE-2026-13399

The CVE refers to the WordPress PayPal WooCommerce Payment Plugins prior to version 2.0.20, which contains an authorization check flaw on a REST endpoint that allows unauthenticated users to bypass payments. Affected component: Payment Plugins for PayPal WooCommerce (WordPress plugin). Root cause...

CVE-2026-13399 Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

CVE-2026-11361 Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...

CVE-2026-11361

Formidable Forms for WordPress (before 6.32.1) is affected by CVE-2026-11361 due to improper validation of PayPal subscription status, enabling unauthenticated users to bypass payment and trigger paid actions (content access, license delivery, membership activation) without charges. Impact aligns...

CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65517 WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65517

The connected documents confirm a vulnerability in the WordPress plugin “Easy PayPal Buy Now Button” affecting versions up to 2.0.4, described as Unauthenticated Cross Site Scripting (XSS). No details on the root cause, exploit method, affected components beyond the plugin, impact metrics, or ava...

EUVD-2026-53968

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...

CVE-2026-15931

The issue is CVE-2026-15931 affecting the Simple Membership WordPress plugin prior to version 4.7.8. The vulnerability arises because the plugin does not sanitize a subscriber name value sent via an unauthenticated payment approval request, and it also fails to escape this value when shown in the...

CVE-2026-10782

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

EUVD-2025-210580

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073

The CVE-2025-14073 entry concerns the WooCommerce PayPal Payments plugin for WordPress (affected versions up to 3.3.2). It describes an Insecure Direct Object Reference flaw in the enqueue_paypal_insights_script_on_order_received() function caused by missing validation on a user-controlled key. T...