Payment Gateway for Telcell < 2.0.4 - Open Redirect

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...

BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass

BlueSnap Payment Gateway for WooCommerce = 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This...

CVE-2026-127204

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-127204 WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-127204

The WooCommerce PayPal Pro Payment Gateway plugin, in versions prior to 4.1.1 , is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler. The flaw exists because the handler is only protected by a public checkout nonce and fails to properly validate the PayPal capt...

EUVD-2026-124596

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

PT-2026-145913

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp capture order AJAX handler, which is gated only by a public checkout nonce and fails to properly...

CVE-2026-127204: wp.insider: WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability…

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2020-28415

CVE-2020-28415 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414. Vulnerability Type Cross Site...

CVE-2020-28414

CVE-2020-28414 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

EUVD-2026-123163

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

PT-2026-144994

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

CVE-2026-111579: Unknown Forminator Forms: The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's…

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

CVE-2026-120856 WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment...

CVE-2026-123145

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the...

CVE-2026-123088

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...

EUVD-2026-119829

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...

CVE-2026-123145

The WooCommerce Stripe Payment Gateway WordPress plugin (versions before 11.1.0 ) contains a vulnerability where account passwords are stored in plaintext within the database. This occurs because the plugin fails to exclude account passwords from the checkout fields saved to order metadata during...

CVE-2026-123088 UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...

CVE-2026-123145 WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the...