7282 matches found
EUVD-2026-90509
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...
CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...
CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...
CVE-2022-1421
CVE-2022-1421 Une preuve de concept pour CVE-2022-1421 Discy Références https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249 https://vulners.com/cve/CVE-2022-1421...
CVE-2026-97299
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97299
The Razorpay Payment Links for WooCommerce WordPress plugin, versions
EUVD-2026-89934
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin Razorpay Payment Links for WooCommerce versions = 2.1.5...
WordPress Verge3D Publishing and E-Commerce plugin 4.1.0-4.13.0 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin Verge3D versions 4.1.0-4.13.0...
WordPress Paymattic plugin 4.6.20-4.6.25 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Artus KG in WordPress Plugin Best Payments Plugin for WP versions 4.6.20-4.6.25...
WordPress Bookly plugin < 28.3 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by vuxvinh in WordPress Plugin Bookly versions 28.3...
CVE-2025-55886
CVE-2025-55886 Description Une vulnérabilité de type Insecure Direct Object Reference IDOR a été découverte dans ARD. Le défaut réside dans le paramètre feuid du point de terminaison d'API de l'historique des paiements. Un attaquant authentifié peut manipuler ce paramètre pour accéder à...
CVE-2026-89411
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...
CVE-2026-92996
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid...
CVE-2026-86838
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step...
billing-hack
Взлом биллинга За информацией об этом коде перейдите по адресу http://sufficientlysecure.org/index.php/2013/10/29/google-play-billing-hacked/...
CVE-2026-92996 Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid...
CVE-2026-92996
The Verge3D WordPress plugin (versions 4.1.0 through 4.13.0 ) contains a vulnerability where it fails to verify payments with the payment provider and lacks order ownership checks. This allows unauthenticated users to mark any order as paid via the v3d_payment_done functionality. No specific reme...