CVE-2026-77765

The Better Payment WordPress plugin, versions prior to 2.3.4 , is vulnerable to an Unauthenticated Payment Amount Manipulation vulnerability. The root cause is a failure to validate submitted payment amounts server-side against the merchant's configured fixed price before constructing the gateway...

CVE-2022-4997

The jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 is vulnerable to an unauthenticated Blind SQL Injection . The root cause is the failure to sanitize and escape a payment token before utilizing it in a SQL statement. This flaw allows unauthenticated attackers to extract...

CVE-2022-4997 JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

EUVD-2022-56060

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

CVE-2022-4997 JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

EUVD-2026-84952

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-93511: Authentication Bypass by Spoofing

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...

CVE-2026-80342: Authorization Bypass Through User-Controlled Key

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

CVE-2026-94179: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...

PT-2026-97161

Name of the Vulnerable Software and Affected Versions Better Payment WordPress plugin versions prior to 2.3.4 Description An issue exists where the plugin fails to validate the submitted payment amount on the server side against the merchant's configured fixed price before the gateway charge is...

CVE-2026-18875: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert CWE-74 in the FTM AI agent server api.vectordb.runbooks.js:51. An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer...

PT-2026-97355

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Stored cross-site scripting occurs in the FTM UI NetworkAcknowledgement React component within the file NetworkAcknowledgement.jsx:42. A...

PT-2026-97303

Name of the Vulnerable Software and Affected Versions SUMIT Payment Gateway for WooCommerce WordPress plugin versions prior to 4.0.0 Description The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows...

CVE-2026-95527: Missing Authorization

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-84091: Improper Authentication

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

PT-2026-97200

Name of the Vulnerable Software and Affected Versions Premium Packages WordPress plugin versions prior to 7.2.1 Description The plugin fails to verify the signature of webhooks received from PayPal when processing payment and subscription notifications. This allows unauthenticated attackers to...

PT-2026-97322

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks...

CVE-2026-18177: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks...

PT-2026-97461

Name of the Vulnerable Software and Affected Versions Razorpay Payment Button versions prior to 2.5.0 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user. Recommendations Update Razorpay Payment Butto...

PT-2026-97186

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description The plugin fails to verify the request signature within the card-token branch of its payment webhook. This flaw allows unauthenticated attackers to enumerate register...