2427 matches found
PT-2025-47825
The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create...
Google Chrome < 83.0.4103.88 Multiple Vulnerabilities
The version of Google Chrome installed on the remote Windows host is prior to 83.0.4103.88. It is, therefore, affected by multiple vulnerabilities as referenced in the 202006stable-channel-update-for-desktop advisory. - Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97...
WordPress Payments Braintree For WooCommerce plugin authorization bypass vulnerability
WordPress Payments Braintree For WooCommerce plugin is a payment plugin designed specifically for WordPress websites, which supports payments done through both PayPal and credit cards. The WordPress Payments Braintree For WooCommerce plugin suffers from an authorization bypass vulnerability that...
CVE-2025-12633
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...
EUVD-2025-119994
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...
CVE-2025-12633
CVE-2025-12633 : The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable due to a missing capability check on the REST endpoint /wp-json/bookit/v1/commerce/stripe/return, affecting all versions up to and including 2.5.0. This allows unauthenticated attackers to conn...
EUVD-2025-38320
Malicious code in payments-notifications npm...
Malicious code in payments-notifications (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2ff3c7a16e539813080b53ccec2b3531078fed7382156c676025c1188b9c7c The package payments-notifications was found to contain malicious code. Source: ossf-package-analysis...
MAL-2025-49390 Malicious code in payments-notifications (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2ff3c7a16e539813080b53ccec2b3531078fed7382156c676025c1188b9c7c The package payments-notifications was found to contain malicious code. Source: ossf-package-analysis...
CVE-2025-60189
The vulnerability CVE-2025-60189 affects the WordPress plugin PoloPag – Pix Automático para Woocommerce (wc-polo-payments), with Local File Inclusion due to improper control of filenames for include/require statements. Affected version range is <= 2.0.9. The issue enables PHP Local File Inclus...
CVE-2025-11835
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMSAJAXCheckoutHandler::processpayment function in all versions up t...
PT-2025-45067
Name of the Vulnerable Software and Affected Versions Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction versions prior to 2.16.5 Description The plugin is susceptible to unauthorized data modification because of a missing capability and validation...
RedTiger Malware Steals Data, Discord Tokens and Even Webcam Images
A new Python-based infostealer called RedTiger is targeting Discord gamers to steal authentication tokens, passwords, and payment information. Learn how the malware works, its evasion tactics, and essential security steps like enabling MFA...
EUVD-2025-35913
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...
CVE-2025-11564 Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...
Canada Fines Cybercrime Friendly Cryptomus $176M
Financial regulators in Canada this week levied $176 million in fines against Cryptomus , a digital payments platform that supports dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The penalties for violating Canada's anti money-laundering laws come ten months...
EUVD-2017-14219
Malware in sbrugna...
EUVD-2014-5751
Malware in sbrugna...