Malicious code in merchantprefsservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145fc1d224cc012a8cbdea5823b1573df6400ce6a24837b2c25710772152724f The package's preinstall script index.js executes automatically on npm install and collects host identifiers — hostname, platform, arch, home directo...

MAL-2026-11057 Malicious code in merchantprefsservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145fc1d224cc012a8cbdea5823b1573df6400ce6a24837b2c25710772152724f The package's preinstall script index.js executes automatically on npm install and collects host identifiers — hostname, platform, arch, home directo...

Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f698d94fead72f888459a0773a7715dd974433c4624134b743098b61e74f9a9f On npm install, the package's preinstall script runs index.js which collects the installer's hostname, platform, architecture, home directory path, a...

MAL-2026-11056 Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f698d94fead72f888459a0773a7715dd974433c4624134b743098b61e74f9a9f On npm install, the package's preinstall script runs index.js which collects the installer's hostname, platform, architecture, home directory path, a...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27087d7e447aae7f5009468024ead0904a706c36775c9a132b43bbcd47d3993c [email protected] declares preinstall: node index.js in package.json, causing index.js to run automatically on npm install. The script...

MAL-2026-11058 Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27087d7e447aae7f5009468024ead0904a706c36775c9a132b43bbcd47d3993c [email protected] declares preinstall: node index.js in package.json, causing index.js to run automatically on npm install. The script...

CVE-2026-12688

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

CVE-2026-12688

The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.7 where PayPal IPN notifications are not verified before granting paid group membership. This allows unauthenticated attackers to Forge a payment notification and set any user as a paid member of any grou...

CVE-2026-12688

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

EUVD-2026-48489

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

CVE-2026-65518

The CVE concerns the WordPress plugin “Accept Donations with PayPal & Stripe” (v <= 1.5.5) and reports a Cross Site Scripting (XSS) vulnerability. Affected product is the WordPress plugin; vulnerability arises from an XSS issue in versions up to 1.5.5 as described in the CVE records. Public re...

EUVD-2026-48121

Contributor Cross Site Scripting XSS in Accept Donations with PayPal & Stripe = 1.5.5 versions...

CVE-2026-59547

CVE-2026-59547 describes an unauthenticated Broken Access Control in the WordPress Payment Gateway for PayPal on WooCommerce plugin, versions

EUVD-2026-48199

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce = 9.1.4 versions...

WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Accept Donations with PayPal & Stripe versions = 1.5.5...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583

Paymenter before v1.5.0 is vulnerable to blind SSRF via the PayPal webhook endpoint /extensions/paypal/webhook. The PAYPAL-CERT-URL HTTP header is read without validation and directly fed into a server-side HTTP request (file_get_contents), allowing an unauthenticated attacker to direct requests ...