CVE-2026-128043

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

CVE-2026-128040

The OpenMage magento-lts platform contains a stored cross-site scripting (XSS) vulnerability in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 . The flaw exists because admin pages render Dataflow profile link variables , tax rate titles , OAuth consumer names , and PayPal certifica...

CVE-2026-128043 OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

EUVD-2026-125065

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

CVE-2026-128043

OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a cross-site request forgery (CSRF) . The vulnerability exists in the PayPal cancel and decline return handlers , which trust the checkout session without verifying that the request originated from...

Accept Donations with PayPal <= 1.5.2 - Open Redirect

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

CVE-2026-73314

CVE-2026-73314: Unsupported PayPal signature algorithm accepted XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm. What happens The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm...

CVE-2026-127204

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-127204 WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-127204

The WooCommerce PayPal Pro Payment Gateway plugin, in versions prior to 4.1.1 , is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler. The flaw exists because the handler is only protected by a public checkout nonce and fails to properly validate the PayPal capt...

EUVD-2026-124596

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-73316

CVE-2026-73316: PayPal webhook replay XenForo before 2.3.13 processes the same valid PayPal REST webhook more than once. What happens The PayPal REST provider overrides XenForo's base transaction validator but omits its duplicate transaction-log lookup. The database index is also non-unique. Two...

CVE-2026-73315

CVE-2026-73315: SSRF through PayPal certificate URL XenForo before 2.3.13 fetches the certificate URL supplied by a PayPal REST webhook without restricting its destination. What happens The callback handler passes PAYPAL-CERT-URL to XenForo's trusted HTTP reader. It does not require a PayPal...

PT-2026-145913

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp capture order AJAX handler, which is gated only by a public checkout nonce and fails to properly...

CVE-2026-127204: wp.insider: WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability…

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

WordPress PayPal Pro <1.1.65 - SQL Injection

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the 'query' parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format. id: CVE-2020-14092 info: name: WordPress PayPal Pro 1.1.65 - SQL Injection...

CVE-2026-126543

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal...

EUVD-2026-123068

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal...

CVE-2026-126543

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal...

CVE-2026-126543: WWBN AVideo: WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that…

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal...