CVE-2026-66611

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

EUVD-2026-63296

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611

CVE-2026-66611 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Paymob for WooCommerce WordPress plugin, affecting versions ≤ 4.1.10 . The flaw was discovered by dutafi and rated CVSS 7.1 (HIGH) with a changed scope, indicating an attacker can execute scripts in a different s...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability

Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205

The CVE concerns the Paymob for WooCommerce WordPress plugin (versions

EUVD-2026-58596

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-56025

Unauthenticated Broken Access Control in Paymob for WooCommerce = 4.1.2 versions...

EUVD-2026-39688

Unauthenticated Broken Access Control in Paymob for WooCommerce = 4.1.2 versions...

CVE-2026-56025 WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Paymob for WooCommerce = 4.1.2 versions...

CVE-2026-56025

CVE-2026-56025 affects the WordPress Paymob for WooCommerce plugin, versioned

WordPress Paymob for WooCommerce plugin <= 4.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sajjad Haqi in WordPress Plugin Paymob for WooCommerce versions = 4.1.3...