Payment Gateway for Telcell < 2.0.4 - Open Redirect

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...

CVE-2020-28415

CVE-2020-28415 Descripción sugerida Existe una vulnerabilidad de cross-site scripting XSS reflejado en TranzWare Payment Gateway 3.1.12.3.2. Un atacante remoto no autenticado puede ejecutar código HTML arbitrario mediante una URL manipulada un vector diferente al de CVE-2020-28414. Tipo de...

CVE-2020-28414

CVE-2020-28414 Descripción sugerida Existe una vulnerabilidad de Cross-Site Scripting XSS reflejado en TranzWare Payment Gateway 3.1.12.3.2. Un atacante remoto no autenticado puede ejecutar código HTML arbitrario mediante una URL manipulada. Tipo de vulnerabilidad Cross-Site Scripting XSS Vendedo...

EUVD-2026-85495

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-95527

The Conekta Payment Gateway WordPress plugin, versions

CVE-2026-93620

The PayPlus Payment Gateway WordPress plugin, in versions

EUVD-2026-85463

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-84091

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mamgad in WordPress Plugin PayPlus Payment Gateway versions = 8.2.5...

CVE-2026-84091

The SUMIT Payment Gateway for WooCommerce WordPress plugin (versions before 4.0.0 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify payment notifications with the payment provider before marking orders as paid. This allows unauthenticated u...

EUVD-2026-85265

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

WordPress SUMIT Payment Gateway for WooCommerce plugin < 4.0.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin SUMIT Payment Gateway for WooCommerce versions 4.0.0...

WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by anhcd05 in WordPress Plugin Conekta Payment Gateway versions = 6.2.4...

EUVD-2026-85050

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

CVE-2026-84091: Improper Authentication

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

CVE-2026-95527: Missing Authorization

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin (before version 9.2.1 ) fails to verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows una...