Fintech Bill Pay Platform “Willow Pays” Exposes Over 240,000 Records

Security researcher discovers a non-password-protected database containing over 240,000 records belonging to US-based FinTech bill payment platform Willow…...

MAL-2025-131 Malicious code in payment-integration-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2b48477c18dc833e42ed72d5398cea9fd403d04bb4f0c43a833f3d97068ae01 The OpenSSF Package Analysis project identified 'payment-integration-template' @ 1.1.0 npm as malicious. It is considered malicious because: - T...

Malicious code in payment-integration-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2b48477c18dc833e42ed72d5398cea9fd403d04bb4f0c43a833f3d97068ae01 The OpenSSF Package Analysis project identified 'payment-integration-template' @ 1.1.0 npm as malicious. It is considered malicious because: - T...

CVE-2024-13401

CVE-2024-13401 affects the WordPress PayPal Payment Button plugin up to version 1.2.3.35. The vulnerability is a Stored XSS in the wp_paypal_checkout shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access at ...

CVE-2025-23804

Cross-Site Request Forgery CSRF vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through = 2.6.0...

CVE-2025-23804

CVE-2025-23804 is a CSRF vulnerability in the WordPress plugin WP Service Payment Form With Authorize.net that can enable a Reflected XSS . The Red Hat advisory reiterates the same CVE and describes the flaw as CSRF affecting the plugin up to version 2.6.0 . The base metrics list a CVSS v3.1 scor...

WordPress WP Service Payment Form With Authorize.net Plugin <= 2.6.0 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

CSRF to Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP Service Payment Form With Authorize.net versions = 2.6.0...

OPEXUS FOIAXpress Public Access Link 安全漏洞

OPEXUS FOIAXpress Public Access Link OPEXUS FOIAXpress PAL is a secure public-facing web portal from OPEXUS that connects organizations with requesters and integrates with payment solutions, including payment solutions. A security vulnerability exists in OPEXUS FOIAXpress Public Access Link versi...

PT-2025-5104 · WordPress · Wp Service Payment Form With Authorize.Net

Name of the Vulnerable Software and Affected Versions: WP Service Payment Form With Authorize.net versions n/a through 2.6.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. This means an attacker can trick a user into performing unintended...

WordPress plugin WP Service Payment Form With Authorize.net 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2024-12919

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pmspbpaymentredirectlink function using the user-controlled value...

CVE-2024-12919

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pmspbpaymentredirectlink function using the user-controlled value...

CVE-2024-12919 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pmspbpaymentredirectlink function using the user-controlled value...

CVE-2024-12919 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pmspbpaymentredirectlink function using the user-controlled value...

PT-2025-1979 · WordPress · Paid Membership Subscriptions

Name of the Vulnerable Software and Affected Versions: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress versions up to, and including, 2.13.7 Description: The issue is due to the pms pb payment redirect link function using the...

WordPress Paid Membership Subscriptions plugin <= 2.13.7 - Authentication Bypass via pms_payment_id vulnerability

Authentication Bypass via pmspaymentid vulnerability discovered by wesley wcraft in WordPress Plugin Paid Member Subscriptions versions = 2.13.7...

WordPress Skimmers Evade Detection by Injecting Themselves into Database Tables

Cybersecurity researchers are warning of a new stealthy credit card skimmer campaign that targets WordPress e-commerce checkout pages by inserting malicious JavaScript code into a database table associated with the content management system CMS. "This credit card skimmer malware targeting WordPre...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

CVE-2024-11810

The PayGreen Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'messageid' parameter in all versions up to, and including, 1.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...