CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-91019

The Event Booking Manager for WooCommerce WordPress plugin (also referred to as WpEvently ) versions prior to 5.6.0 is vulnerable to an improper access control flaw. The plugin fails to restrict access to its stored payment gateway configurations, allowing users with Contributor-level access or h...

WordPress Event Booking Manager for WooCommerce plugin < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure vulnerability

Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.6.0...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81349

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

EUVD-2026-81350

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin (versions before 3.0.9 ) contains an Improper Access Control vulnerability. The software fails to verify if the amount and currency reported by the payment provider match the pending payment details before completing the transaction. This allows ...

CVE-2026-90923

The Autopay WordPress plugin (versions before 5.0.1 ) is vulnerable to an incorrect authorization flaw because it fails to enforce signatures on specific payment callbacks. This security weakness allows unauthenticated users to perform cross-customer actions, specifically the disclosure and delet...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

PT-2026-95065

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...

PT-2026-95191

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.1 Description The Accounting plugin fails to sanitize the Payment Term note field, rendering it as raw HTML. Authenticated users with payment-term create permissions can submit arbitrary JavaScript to the...

PT-2026-94174

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the plugin fails to enforce the signature on a payment callback. This allows unauthenticated users to disclose and delete stored payment parameters associated...

PT-2026-94173

Name of the Vulnerable Software and Affected Versions Paid Membership Subscriptions versions prior to 3.0.9 Description An issue exists where the plugin fails to verify if the amount and currency reported by the payment provider match the pending payment before completion. This allows...

CVE-2026-93454: Improper Neutralization of Input During Web Page Generation

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-91017: Insufficient Verification of Data Authenticity

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

PT-2026-95143

Name of the Vulnerable Software and Affected Versions MythicalDash versions prior to 3.5.4-aurora Description An unauthenticated payment bypass exists in the Stripe success-redirect mechanism. The endpoint '/api/stripe/process' creates a pending payment record before checkout is completed and...