CVE-2026-81740

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

PT-2026-104085

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

CVE-2026-81809

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81739

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

EUVD-2026-90510

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81809 Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81809

The Paytm Payment Gateway WordPress plugin, in versions prior to 2.8.9 , is vulnerable to SQL injection . The root cause is the failure to properly escape data retrieved from payment callbacks before inclusion in a SQL statement. Additionally, the integrity check for these callbacks can be forged...

CVE-2026-81809 Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

EUVD-2026-90509

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

CVE-2026-81739

The Paytm Payment Gateway WordPress plugin (versions before 2.8.9 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape data received from payment callbacks before it is displayed on an admin page. Additionally, the integrity che...

CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

CVE-2026-81809: Improper Neutralization of Special Elements used in an SQL Command

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

CVE-2026-81739: Improper Neutralization of Input During Web Page Generation

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

PT-2026-103700

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perfor...

PT-2026-103699

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

DRUPAL-CONTRIB-2026-130

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...

PT-2026-84894

Name of the Vulnerable Software and Affected Versions Drupal Monobank payment API versions 0.0.0 through 1.0.3 Description The Monobank payment API module, used for integrating Monobank acquiring payments, fails to verify the cryptographic signature of webhooks before processing payment status...

CVE-2026-12584

Technical details (affected versions, root cause, impact, fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-11575

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...