CVE-2026-87979: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

PT-2026-97187

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description Insufficient capability checks on several admin AJAX actions used to manage payment-gateway configuration allow users with contributor-level access to delete, wipe, o...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

PT-2026-97186

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description The plugin fails to verify the request signature within the card-token branch of its payment webhook. This flaw allows unauthenticated attackers to enumerate register...

CVE-2026-66611

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

EUVD-2026-63296

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611

CVE-2026-66611 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Paymob for WooCommerce WordPress plugin, affecting versions ≤ 4.1.10 . The flaw was discovered by dutafi and rated CVSS 7.1 (HIGH) with a changed scope, indicating an attacker can execute scripts in a different s...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

PT-2026-78969

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability

Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin (versions before 4.1.9 ) is vulnerable to unauthenticated SQL injection . The root cause is the improper sanitization of a client-supplied identifier used in a SQL query within a public payment callback. Critically, the plugin performs this query before...

EUVD-2026-58596

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205: Improper Neutralization of Special Elements used in an SQL Command

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...