CVE-2026-5109 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validation and output escaping of Product Option field values. The vulnerability exists because the state validation function accepts submitted...

PT-2025-11699

Name of the Vulnerable Software and Affected Versions Syliud PayPal Plugin versions prior to 1.6.2 Syliud PayPal Plugin versions prior to 1.7.2 Syliud PayPal Plugin versions prior to 2.0.2 Description A discovered issue allows users to modify their shopping cart after completing the PayPal Checko...

CVE-2025-30152: External Control of Assumed-Immutable Web Parameter

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal...