7630 matches found
WordPress Nexi XPay Build plugin 7.6.1-7.6.2 - Unauthenticated Saved Payment Token Disclosure vulnerability
Unauthenticated Saved Payment Token Disclosure vulnerability discovered by ryan fabella in WordPress Plugin Nexi XPay Build versions 7.6.1-7.6.2...
CVE-2026-82213 Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
WordPress WP Express Checkout plugin < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment vulnerability
Unauthenticated Payment Bypass via wpecprocesspayment vulnerability discovered by Amity Gilmour in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.4.9...
WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Simple Payment versions = 2.5.4...
PT-2026-89836
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
PT-2026-89837
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...
PT-2026-90026
Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...
CVE-2026-62111: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...
CVE-2026-82215: Insufficient Verification of Data Authenticity
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...
CVE-2026-82213: Authorization Bypass Through User-Controlled Key
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
PT-2026-89839
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
Protecting organizations from AI-assisted executive impersonation and invoice fraud
In this article 1. Attack chain overview 1. Email Delivery 2. Domain registration 3. Generative AI usage 2. Mitigation and protection guidance 1. Microsoft Defender detections 2. Microsoft Security Copilot 3. Threat intelligence reports 4. MITRE ATT&CK Techniques observed 5. Indicators of...
CVE-2026-78536
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
CVE-2026-78536
CVE-2026-78536 affects the Robokassa payment gateway for Woocommerce WordPress plugin in versions 1.8.9 and earlier . The vulnerability is an unauthenticated Broken Access Control , meaning an attacker with no prior credentials can exploit it over the network. The CVSS 3.1 score is 6.5 (Medium) w...
EUVD-2026-75513
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
WordPress WP Express Checkout plugin < 2.5.0 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by ryan zegar in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.5.0...
WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Subscriber+ Stored Payment Method Assignment vulnerability
Subscriber+ Stored Payment Method Assignment vulnerability discovered by m1w34p0n & krypt3d in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...