130 matches found
CVE-2026-110285
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying...
EUVD-2026-109341
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying...
CVE-2026-110285 WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying...
CVE-2026-110285
The WP Stripe Checkout WordPress plugin (versions before 1.2.2.62 ) contains a vulnerability where it fails to verify Stripe webhook signatures when no signing secret is configured. Since no signing secret is configured by default, unauthenticated attackers can forge a payment completion notifica...
CVE-2026-110285 WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying...
WordPress WP Stripe Checkout plugin < 1.2.2.62 - Unauthenticated Forged Payment Completion vulnerability
Unauthenticated Forged Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Stripe Checkout versions 1.2.2.62...
PT-2026-122939
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying...
CVE-2026-109937
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...
CVE-2026-109937 Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...
CVE-2026-109937 Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...
EUVD-2026-103390
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...
CVE-2026-109937
The Otter Blocks WordPress plugin (versions before 3.2.3 ) is vulnerable to an unauthenticated open redirect . The root cause is a failure to validate that a user-supplied return URL belongs to the site when building the return destination for a Stripe Checkout session . This allows an attacker t...
CVE-2026-109937: URL Redirection to Untrusted Site
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...
PT-2026-116545
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary...
CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...
EUVD-2026-95982
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...
CVE-2026-107852
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...
CVE-2026-107852
In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...
CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...
BIT-GHOST-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...