CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin, in versions 1.8 through 2.0.5 , is vulnerable to unauthenticated payment amount manipulation . The root cause is that the plugin fails to derive the payment amount on the server, instead relying on a client-supplied field . This allows an ...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

WordPress Easy PayPal & Stripe Buy Now Button plugin 1.8-2.0.5 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Easy PayPal Buy Now Button versions 1.8-2.0.5...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

EUVD-2026-91213

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

PT-2026-104112

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987: External Control of Assumed-Immutable Web Parameter

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

MAL-2026-13551 Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65517: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...

Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074 On require, index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via...

Malicious code in bnpl-blocks-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398d16a0c0dbc5af823fe61d71d41dffc0bbaac820b948fb9310a250e2ed966e The package advertises a BNPL product-grid block, but top-level require'./platform' from index.js triggers platform.js, which on load selects a...

MAL-2026-12963 Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0 On require of bnpl-blocks-independent-bnpl-open-api, index.js loads support.js which unconditionally executes at module load. support.js selects a...

MAL-2026-12973 Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a On require of this package, index.js loads adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split...

MAL-2026-13005 Malicious code in bnpl-blocks-mobile-bnpl-shopping-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a04004bb44c701e1976ef3d6678efb4cd9668d5a4986937c62928d1345550a86 On require of this package, index.js loads polyfill.js which selects a platform-specific download URL, reconstructs hostnames via array.join...

Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...