PT-2026-103708

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

PT-2026-103747

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-97661: Improper Neutralization of Input During Web Page Generation

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96200: Missing Authorization

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

CVE-2026-96255: Exposure of Sensitive Information to an Unauthorized Actor

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

CVE-2026-96173: Authorization Bypass Through User-Controlled Key

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

PT-2026-103710

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

SUSE CVE-2026-102310

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-96818

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

EUVD-2026-89871

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818

The WP Express Checkout (Accept PayPal Payments) plugin for WordPress is affected by an unauthenticated Broken Access Control vulnerability in versions

CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

PT-2026-103203

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818: Missing Authorization

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-102310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origi...

CVE-2026-102310

A missing authorization flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=477726837 https://code.google.com/p/chromium/issues/detail?id=102310...

DEBIAN-CVE-2026-102310

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102310

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102310

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...