CVE-2026-89100

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

EUVD-2026-96220

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-89100

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 4.0.17 . The root cause is insufficient input sanitization and output escaping specifically via the '#response' URL Fragment . This allows unau...

CVE-2026-89100 Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.27 - Unauthenticated Payment Hijacking vulnerability

Unauthenticated Payment Hijacking vulnerability discovered by m1w34p0n & krypt3d in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.27...

CVE-2026-80342

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

EUVD-2026-85027

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

CVE-2026-80342 Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

CVE-2026-80342

The Payment Plugins for PayPal WooCommerce WordPress plugin (versions before 2.0.27 ) is vulnerable to an unauthenticated payment hijacking attack. The root cause is a failure to verify that a supplied PayPal order belongs to the specific WooCommerce order being paid, unless the PayPal order is a...

CVE-2026-80342 Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

PT-2026-97163

Name of the Vulnerable Software and Affected Versions Payment Plugins for PayPal WooCommerce WordPress plugin versions prior to 2.0.27 Description The plugin fails to verify if a PayPal order provided in a payment request corresponds to the WooCommerce order being processed, provided the PayPal...

CVE-2026-80342: Authorization Bypass Through User-Controlled Key

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

EUVD-2026-74706

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...

CVE-2026-80340: Exposure of Sensitive Information to an Unauthorized Actor

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

CVE-2026-80341: Incorrect Authorization

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...

CVE-2026-80339: Exposure of Sensitive Information to an Unauthorized Actor

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability

Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability discovered by Shivamani Vastrala in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.20...

CVE-2026-13399: Authorization Bypass Through User-Controlled Key

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

PT-2026-68644

Name of the Vulnerable Software and Affected Versions Payment Plugins for PayPal WooCommerce WordPress plugin versions prior to 2.0.20 Description Insufficient authorization checks on a REST endpoint allow unauthenticated users to bypass payments. Recommendations Update the plugin to version 2.0....

CVE-2026-12654: Missing Authorization

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...