WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection

WordPress Paytm Donation plugin through 1.3.2 is susceptible to authenticated SQL injection. The plugin does not sanitize, validate, or escape the id GET parameter before using it in a SQL statement when deleting donations. An attacker can possibly obtain sensitive information, modify data, and/o...

WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection

WordPress Paytm Payment Gateway plugin through 2.7.3 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-45805 info: name: WordPress Payt...

CVE-2026-81740

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Artus KG in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

EUVD-2026-91201

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

CVE-2026-81740

The Paytm Payment Gateway WordPress plugin in versions before 2.8.9 is vulnerable to unauthenticated order status manipulation. The root cause is a failure to verify that payment callbacks genuinely originate from the payment provider when the secret key has not been configured, which is the defa...

CVE-2026-81740: Improper Authentication

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

PT-2026-104085

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-102269 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

django-oscar-moysklad (>=0.2.0, <=0.2.3), drf-paytm (0.0.1) +3 more potentially affected by CVE-2026-15307 via django (2.1.3)

django PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-oscar-moysklad =0.2.0, =1.4.3, =1.6.5 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

CVE-2026-81809

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81739

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

EUVD-2026-90510

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81809 Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81809

The Paytm Payment Gateway WordPress plugin, in versions prior to 2.8.9 , is vulnerable to SQL injection . The root cause is the failure to properly escape data retrieved from payment callbacks before inclusion in a SQL statement. Additionally, the integrity check for these callbacks can be forged...