3122 matches found
CVE-2026-96200
The Payments for Hubtel WordPress plugin (versions before 1.0.2 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify that payment notifications received via the plugin's payment callback actually originate from the legitimate payment provider....
EUVD-2026-90519
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...
CVE-2026-96173
The Payments for Hubtel WordPress plugin, in versions prior to 1.0.2 , contains an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the plugin fails to verify if a requester is authorized to view an order before redirecting a public payment-callback request. This all...
PT-2026-103747
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-103710
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...
PT-2026-103708
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...
CVE-2026-96200: Missing Authorization
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...
CVE-2026-96173: Authorization Bypass Through User-Controlled Key
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...
CVE-2026-97661: Improper Neutralization of Input During Web Page Generation
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-103709
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...
CVE-2026-96255: Exposure of Sensitive Information to an Unauthorized Actor
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...
SUSE CVE-2026-102310
Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-96818
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
EUVD-2026-89871
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
CVE-2026-96818
The WP Express Checkout (Accept PayPal Payments) plugin for WordPress is affected by an unauthenticated Broken Access Control vulnerability in versions
CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
PT-2026-103203
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-102310
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origi...