CVE-2026-77689

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

CVE-2026-77689 Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

EUVD-2026-76813

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...

Payment Gateway for Telcell < 2.0.4 - Open Redirect

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...

CVE-2020-28415

CVE-2020-28415 Descripción sugerida Existe una vulnerabilidad de cross-site scripting XSS reflejado en TranzWare Payment Gateway 3.1.12.3.2. Un atacante remoto no autenticado puede ejecutar código HTML arbitrario mediante una URL manipulada un vector diferente al de CVE-2020-28414. Tipo de...

CVE-2020-28414

CVE-2020-28414 Descripción sugerida Existe una vulnerabilidad de Cross-Site Scripting XSS reflejado en TranzWare Payment Gateway 3.1.12.3.2. Un atacante remoto no autenticado puede ejecutar código HTML arbitrario mediante una URL manipulada. Tipo de vulnerabilidad Cross-Site Scripting XSS Vendedo...

CVE-2026-78536

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

EUVD-2026-75513

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-78536

CVE-2026-78536 affects the Robokassa payment gateway for Woocommerce WordPress plugin in versions 1.8.9 and earlier . The vulnerability is an unauthenticated Broken Access Control , meaning an attacker with no prior credentials can exploit it over the network. The CVSS 3.1 score is 6.5 (Medium) w...

WordPress ePayco Payment Gateway for WooCommerce plugin < 8.4.7 - Unauthenticated Payment Confirmation Bypass vulnerability

Unauthenticated Payment Confirmation Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Epayco versions 8.4.7...

CVE-2026-84043

The ePayco Payment Gateway for WooCommerce WordPress plugin, in versions before 8.4.7 , fails to properly verify the authenticity of payment confirmation requests. This allows unauthenticated attackers to mark orders as paid without presenting a valid gateway signature, resulting in a low integri...

EUVD-2026-70991

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

EUVD-2026-68992

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

CVE-2026-13611

The KiviCare WordPress plugin (a Clinic & Patient Management System / EHR) prior to version 4.5.5 is missing authorization checks on certain REST endpoints , enabling unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

CVE-2026-13611 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

EUVD-2026-68044

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-16738

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...